RoPoLL: Robust Panel of LLM Judges

# RoPoLL: Robust Panel of LLM Judges
Source: [https://arxiv.org/html/2606.30931](https://arxiv.org/html/2606.30931)
Anish Acharya Amazon Web Services achanish@amazon\.com &Kris W\. Pan Amazon Web Services kriswpan@amazon\.com &Brian Verkhovsky Amazon Web Services bverkhov@amazon\.com

Abstract\.The LLM Jury, a*Panel of LLM Evaluators*\(PoLL\)\(Vergaet al\.,[2024](https://arxiv.org/html/2606.30931#bib.bib5)\)reporting consensus scores, has become a practical alternative to single judge LLM evaluation, yet its statistical behaviour remains poorly understood\. We formalize the LLM Jury setup under the Huber contamination model, and show thatPoLLincurs unbounded bias under any positive contamination, regardless of jury size, whenever a single judge fails in a biased, LLM\-typical way \(mode collapse, sycophancy, safety refusal\)\. We frame the jury consensus problem as an instance of classical robust mean estimation and proposeRoPoLL\(RobustPanelofLLM\-as\-Judge\), which preserves thePoLLpanel and substitutes the aggregation function with a robust mean estimator\. Among classical robust estimators, we instantiateRoPoLLwith the geometric median \(GM\), a tuning\-free, joint\-distance\-preserving mean estimator that yields the optimal finite\-sample breakdown point1/21/2\. We establish a finite\-sample error bound and an information\-theoretic minimax lower bound that match on the parametric rateσ​d/N\\sigma\\sqrt\{d/N\}and differ on the breakdown floor by a factor ofd\\sqrt\{d\}– a statistical\-computational gap that polynomial\-timeRoPoLLpays relative to the \(intractable\) Tukey halfspace median\. Across1313open\-weight judges \(44B–675675B\), three reward\-model benchmarks, and four corruption regimes at rates up to50%50\\%,RoPoLLdominatesPoLLon every biased corruption type: by≈19%\\approx 19\\%on cross\-dimensional attacks at matched compute, and by orders of magnitude on heavy\-tailed Byzantine adversaries \(whose unbounded first moments make any breakdown\-positive aggregator beat averaging unconditionally\)\. A33\-judgeRoPoLLcommittee at3838B beats Mistral\-Large\-3 \(675675B\) by1\.31×1\.31\\timeson HelpSteer\-2 under30%30\\%bimodal\-randomcorruption – an18×18\\timesparameter advantage with strictly better accuracy\. A Noisy\-GT control confirms the premium is paid against*biased*contamination, not benign Gaussian imprecision \(wherePoLLis statistically optimal\)\. Overall, we establish that robust aggregation of a small, diverse committee is a parameter\-efficient and statistically principled alternative to scaling a single large LLM\-as\-judge\.Correspondence:achanish@amazon\.com![[Uncaptioned image]](https://arxiv.org/html/2606.30931v1/x1.png)

###### Contents

1. [1Introduction](https://arxiv.org/html/2606.30931#S1)
2. [2Related Work](https://arxiv.org/html/2606.30931#S2)
3. [3Problem Setup](https://arxiv.org/html/2606.30931#S3)1. [3\.1System Agent and Reward Space](https://arxiv.org/html/2606.30931#S3.SS1) 2. [3\.2Reference Protocol, Rubric, and Parser](https://arxiv.org/html/2606.30931#S3.SS2) 3. [3\.3LLM Jury and Aggregation Function](https://arxiv.org/html/2606.30931#S3.SS3) 4. [3\.4Huber Contamination Model and Companion Assumptions](https://arxiv.org/html/2606.30931#S3.SS4) 5. [3\.5Observation Model and Variance Reduction](https://arxiv.org/html/2606.30931#S3.SS5) 6. [3\.6Fragility ofPoLL](https://arxiv.org/html/2606.30931#S3.SS6)
4. [4Robust Panel of LLM Judges](https://arxiv.org/html/2606.30931#S4)1. [4\.1Choosing the Robust Estimator](https://arxiv.org/html/2606.30931#S4.SS1) 2. [4\.2The Geometric Median: Definition and Properties](https://arxiv.org/html/2606.30931#S4.SS2) 3. [4\.3The Weiszfeld Iteration](https://arxiv.org/html/2606.30931#S4.SS3)
5. [5Theoretical Guarantees](https://arxiv.org/html/2606.30931#S5)1. [5\.1Finite\-Sample Error Bound](https://arxiv.org/html/2606.30931#S5.SS1) 2. [5\.2Minimax Lower Bound](https://arxiv.org/html/2606.30931#S5.SS2)
6. [6Experiments](https://arxiv.org/html/2606.30931#S6)1. [6\.1Setup](https://arxiv.org/html/2606.30931#S6.SS1) 2. [6\.2Heavy\-Tailed Corruption](https://arxiv.org/html/2606.30931#S6.SS2) 3. [6\.3Cross\-Dimensional Corruption](https://arxiv.org/html/2606.30931#S6.SS3) 4. [6\.4Bounded Mean\-Preserving Corruptions: Zeros and Inverted](https://arxiv.org/html/2606.30931#S6.SS4) 5. [6\.5Clean\-Baseline Parameter Efficiency](https://arxiv.org/html/2606.30931#S6.SS5) 6. [6\.6Jury\-Size Ablation and Corruption\-Type Dependence](https://arxiv.org/html/2606.30931#S6.SS6) 7. [6\.7Noisy\-GT Control: Systematic Bias, Not Imprecision](https://arxiv.org/html/2606.30931#S6.SS7) 8. [6\.8Released Corpus](https://arxiv.org/html/2606.30931#S6.SS8) 9. [6\.9Inter\-Judge Correlation Structure](https://arxiv.org/html/2606.30931#S6.SS9) 10. [6\.10Empirical Indicator Correlationγ¯W\\bar\{\\gamma\}\_\{W\}](https://arxiv.org/html/2606.30931#S6.SS10) 11. [6\.11Practical Recommendation](https://arxiv.org/html/2606.30931#S6.SS11)
7. [7Conclusion](https://arxiv.org/html/2606.30931#S7)
8. [References](https://arxiv.org/html/2606.30931#bib)
9. [AComplete Proofs and Full Theoretical Development](https://arxiv.org/html/2606.30931#A1)1. [A\.1Proof of Proposition1\(Variance Reduction\)](https://arxiv.org/html/2606.30931#A1.SS1) 2. [A\.2Proof of Proposition2\(Unbounded Bias ofPoLL\)](https://arxiv.org/html/2606.30931#A1.SS2) 3. [A\.3Proof of Proposition3](https://arxiv.org/html/2606.30931#A1.SS3) 4. [A\.4Weiszfeld Iteration: Full Derivation, Convergence, and Cost](https://arxiv.org/html/2606.30931#A1.SS4) 5. [A\.5Proof of Lemma1](https://arxiv.org/html/2606.30931#A1.SS5) 6. [A\.6Proof of Lemma2](https://arxiv.org/html/2606.30931#A1.SS6) 7. [A\.7Proof of Theorem1](https://arxiv.org/html/2606.30931#A1.SS7) 8. [A\.8Proof of Lemma3](https://arxiv.org/html/2606.30931#A1.SS8) 9. [A\.9Proof of Theorem2](https://arxiv.org/html/2606.30931#A1.SS9)
10. [BAdditional Experiments](https://arxiv.org/html/2606.30931#A2)1. [B\.1Synthetic 2D Simulation: Visual Intuition](https://arxiv.org/html/2606.30931#A2.SS1) 2. [B\.2Per\-Model and Per\-Dimension Calibration Breakdowns](https://arxiv.org/html/2606.30931#A2.SS2)

## 1Introduction

Reliable evaluation remains the bottleneck in aligning Large Language Models \(LLMs\)\. Human evaluation, while the gold standard, does not scale to the iterative development cycles that modern alignment pipelines demand\. The field has therefore converged on the*LLM\-as\-a\-Judge*paradigm\(Zhenget al\.,[2023](https://arxiv.org/html/2606.30931#bib.bib1)\), in which another LLM \(typically a frontier model\) acts as a referee, scoring outputs along one or more quality attributes\. Subsequent work has trained open judges to match this behaviour\(Kimet al\.,[2024](https://arxiv.org/html/2606.30931#bib.bib7)\)and standardised rubric\-based evaluation protocols\(Liet al\.,[2023](https://arxiv.org/html/2606.30931#bib.bib8); Duboiset al\.,[2024](https://arxiv.org/html/2606.30931#bib.bib9); Yeet al\.,[2024](https://arxiv.org/html/2606.30931#bib.bib10)\)\. A single judge, however, is a single point of statistical failure\. The systematic biases its backbone exhibits, e\.g\., position, verbosity, self\-enhancement, sycophancy, and refusal artefacts, are by now well documented\(Wanget al\.,[2023](https://arxiv.org/html/2606.30931#bib.bib6); Panicksseryet al\.,[2024](https://arxiv.org/html/2606.30931#bib.bib2); Saitoet al\.,[2023](https://arxiv.org/html/2606.30931#bib.bib3); Stureborget al\.,[2024](https://arxiv.org/html/2606.30931#bib.bib4)\); they propagate uncorrected to every score, and the cost\-quality profile of the resulting evaluation is fixed to that of the single model\.

A natural remedy is to evaluate by committee\. The*LLM Jury*, instantiated by the*Panel of LLM Evaluators*\(PoLL\) ofVergaet al\.\([2024](https://arxiv.org/html/2606.30931#bib.bib5)\), ensembles smaller, diverse, cheaper backbones and reports the arithmetic mean of their scores as the consensus—sufficient, in their experiments, to match or exceed a single large judge\. Related multi\-model evaluators include peer\-rank discussion\(Liet al\.,[2024](https://arxiv.org/html/2606.30931#bib.bib11)\), multi\-agent debate\(Chanet al\.,[2024](https://arxiv.org/html/2606.30931#bib.bib12)\), and deeper/wider judge networks\(Zhanget al\.,[2024](https://arxiv.org/html/2606.30931#bib.bib14)\); these vary the panel structure but inheritPoLL’s aggregation rule\.PoLLis the optimal aggregator precisely when judge errors are light\-tailed and centered on the truth, in which case averagingNNjudges contracts the variance at the parametric rate1/N1/N\(Proposition[1](https://arxiv.org/html/2606.30931#Thmproposition1), §[3\.5](https://arxiv.org/html/2606.30931#S3.SS5)\);[Figure˜10](https://arxiv.org/html/2606.30931#S6.F10)\(§[6\.5](https://arxiv.org/html/2606.30931#S6.SS5)\) shows the clean\-baseline parameter\-efficiency this delivers empirically\.

#### The problem: Byzantine failures, not Gaussian noise\.

Real LLM judges fail in ways that are nothing like Gaussian noise\. A judge that produces malformed JSON triggers a parser fallback to the all\-zeros score, dropping a single observation onto the boundary of the score space\. A judge with sycophancy bias rates every response near the maximum, flattening genuine quality differences\. A judge that handles one attribute well may catastrophically mis\-score another, producing a vector that is plausible per axis yet jointly anomalous\. A judge whose parser hallucinates can emit values entirely outside the bounded score scale\. These four failure modes—*mode collapse*,*sycophancy*,*cross\-attribute confusion*, and*heavy\-tailed hallucination*—are all*biased point masses far from the truth*, not symmetric perturbations of it, and each occurs in real deployments at non\-trivial rates: in our corpus, parser\-failure alone reaches33%33\\%on the smallest judge \(Gemma\-4B\) for HelpSteer 3 multilingual prompts, with mean rates of3\.4%3\.4\\%on HelpSteer 3 and0\.6%0\.6\\%on HelpSteer 2 across the1313\-judge panel \([Figure˜2](https://arxiv.org/html/2606.30931#S3.F2), §[3\.4](https://arxiv.org/html/2606.30931#S3.SS4)\)\.

This is the regime the classical robust\-statistics literature\(Huber,[1964](https://arxiv.org/html/2606.30931#bib.bib31); Tukey,[1960](https://arxiv.org/html/2606.30931#bib.bib15); Small,[1990](https://arxiv.org/html/2606.30931#bib.bib27); Vardi and Zhang,[2000](https://arxiv.org/html/2606.30931#bib.bib28); Minsker,[2015](https://arxiv.org/html/2606.30931#bib.bib30); Lugosi and Mendelson,[2019](https://arxiv.org/html/2606.30931#bib.bib16)\)and Byzantine\-robust optimisation literature\(Blanchardet al\.,[2017](https://arxiv.org/html/2606.30931#bib.bib17); Yinet al\.,[2018](https://arxiv.org/html/2606.30931#bib.bib18); El Mhamdiet al\.,[2018](https://arxiv.org/html/2606.30931#bib.bib19); Acharyaet al\.,[2022](https://arxiv.org/html/2606.30931#bib.bib33),[2025](https://arxiv.org/html/2606.30931#bib.bib32)\)identify as the wrong regime forPoLL\-style aggregation\. The Huberϵ\{\\epsilon\}\-contamination model \(Assumption[2](https://arxiv.org/html/2606.30931#Thmassumption2)\) admits all four failure modes as specific instantiations of the contamination distributionQiQ\_\{i\}\(zeros,inverted,bimodal\-random, andcauchy\-far; mapped explicitly in §[3\.4](https://arxiv.org/html/2606.30931#S3.SS4)and evaluated in §[6\.2](https://arxiv.org/html/2606.30931#S6.SS2)–[6\.4](https://arxiv.org/html/2606.30931#S6.SS4)\), and a direct calculation \(Proposition[2](https://arxiv.org/html/2606.30931#Thmproposition2), §[3\.6](https://arxiv.org/html/2606.30931#S3.SS6)\) shows that under*any*positive contamination ratePoLL’s conditional bias grows linearly with the corruption shift and is unbounded over the corruption class, regardless ofNN: the1/N1/Nvariance reduction that motivates juries cannot rescue an aggregator whose bias is itself unbounded\.

![Refer to caption](https://arxiv.org/html/2606.30931v1/)\(a\)HelpSteer 2
![Refer to caption](https://arxiv.org/html/2606.30931v1/x3.png)\(b\)HelpSteer 3
![Refer to caption](https://arxiv.org/html/2606.30931v1/x4.png)\(c\)UltraFeedback

Figure 1:PoLLvs\.RoPoLLunder heavy\-tailedcauchy\-farcorruption\.RMSE vs\. per\-case corruption raterr\(logyy\-axis\) for theMediumjury \(N=3N\{=\}3,≈89\{\\approx\}89B\), with the best single open\-weight judge as a gray dashed reference; coordinate\-wiseMedianis competitive withRoPoLLhere and is omitted \(full three\-method comparison in[Figure˜12](https://arxiv.org/html/2606.30931#S6.F12)\)\. Each corrupted slot is drawn asy^=y⋆\+10\+2​\(smax−smin\)​T\\hat\{y\}=y^\{\\star\}\+10\+2\(s\_\{\\max\}\{\-\}s\_\{\\min\}\)\\,TwithTTcomponent\-wise standard Cauchy: a biased heavy\-tailed Byzantine attack with undefined mean and variance, instantiating the adversarial choice in Proposition[2](https://arxiv.org/html/2606.30931#Thmproposition2)\.
#### Overview of our approach\.

We proposeRoPoLL\(RobustPanelofLLM\-as\-Judge\), a drop\-in replacement for the arithmetic\-mean aggregation step ofPoLLwith a robust mean estimator\. Among classical candidates—the coordinate\-wise median \(CoMed\), the trimmed mean, and the geometric median \(GM\)—only GM is simultaneously*tuning\-free*\(no contamination\-rate hyperparameter unlike the trimmed mean\),*joint\-distance preserving*\(operates on Euclidean distance over the full score vector unlike CoMed, which decouples coordinates and misses cross\-attribute structure of Example[1](https://arxiv.org/html/2606.30931#Thmexample1)\), and attains the optimal1/21/2breakdown point \(Definition[8](https://arxiv.org/html/2606.30931#Thmdefinition8), Proposition[3](https://arxiv.org/html/2606.30931#Thmproposition3)\); the comparison is developed in detail in §[4\.1](https://arxiv.org/html/2606.30931#S4.SS1)\. We instantiateRoPoLLwith the geometric median \(Definition[7](https://arxiv.org/html/2606.30931#Thmdefinition7)\), computed via the modified Weiszfeld iteration \(Algorithm[1](https://arxiv.org/html/2606.30931#alg1), §[4\.3](https://arxiv.org/html/2606.30931#S4.SS3)\) atO​\(N​d​log⁡\(1/ϵ\)\)O\(Nd\\log\(1/\{\\epsilon\}\)\)per query\. CoMed and the trimmed mean serve as empirical baselines in §[6](https://arxiv.org/html/2606.30931#S6)\.

#### Contributions\.

- •Formalisation\.We give the first formal treatment of LLM jury aggregation as a robust mean\-estimation problem \(§[3](https://arxiv.org/html/2606.30931#S3)\): we model the LLM\-as\-Judge pipeline as a Markov kernel \(Definition[4](https://arxiv.org/html/2606.30931#Thmdefinition4)\), define the LLM Jury \(Definition[5](https://arxiv.org/html/2606.30931#Thmdefinition5)\), and characterise judge failures as Byzantine faults under the Huber contamination model \(Assumption[2](https://arxiv.org/html/2606.30931#Thmassumption2)\)\. Proposition[2](https://arxiv.org/html/2606.30931#Thmproposition2)shows thatPoLLadmits unbounded bias under this model\.
- •Algorithm and theory\.We proposeRoPoLL\(§[4](https://arxiv.org/html/2606.30931#S4)\) and establish its theoretical guarantees \(§[5](https://arxiv.org/html/2606.30931#S5)\): a finite\-sample upper bound‖𝐲^GM−𝐲⋆‖2≤Cα\+β​ρ\\\|\\hat\{\{\\mathbf\{y\}\}\}\_\{\\mathrm\{GM\}\}\-\{\\mathbf\{y\}\}^\{\\star\}\\\|\_\{2\}\\leq C\_\{\\alpha\+\\beta\}\\rhowith explicit absolute constants \(Theorem[1](https://arxiv.org/html/2606.30931#Thmtheorem1)\), a correlated\-jury extension under the equicorrelated\-indicator hypothesis \(Lemma[3](https://arxiv.org/html/2606.30931#Thmlemma3), with empirical indicator\-correlationγ¯W∈\[0\.45,0\.53\]\\bar\{\\gamma\}\_\{W\}\\in\[0\.45,0\.53\]measured on our judge panels,[Section˜6\.10](https://arxiv.org/html/2606.30931#S6.SS10)\), and an information\-theoretic minimax lower bound \(Theorem[2](https://arxiv.org/html/2606.30931#Thmtheorem2)\) that matches on the parametric rateσ​d/N\\sigma\\sqrt\{d/N\}and differs on the breakdown floor by ad\\sqrt\{d\}statistical–computational gap, attributed to GM’s polynomial\-time tractability relative to the \(intractable\) Tukey halfspace median\.
- •Large\-scale empirical validation\.We evaluate1313open\-weight LLM judges spanning four model\-size tiers \(44B–675675B parameters\) on three benchmarks with complementary ground\-truth sources: HelpSteer 2\(Wanget al\.,[2024](https://arxiv.org/html/2606.30931#bib.bib25)\), HelpSteer 3\(Wanget al\.,[2025](https://arxiv.org/html/2606.30931#bib.bib48)\), and UltraFeedback\(Cuiet al\.,[2024](https://arxiv.org/html/2606.30931#bib.bib49)\)\. Under systematic adversarial injection at contamination rates up to50%50\\%\(§[6](https://arxiv.org/html/2606.30931#S6)\),RoPoLLoutperformsPoLLby up to three orders of magnitude on biased heavy\-tailed \(cauchy\-far,[Figure˜1](https://arxiv.org/html/2606.30931#S1.F1)\) and cross\-dimensional \(bimodal\-random,[Figure˜8](https://arxiv.org/html/2606.30931#S6.F8)\) attacks; a33\-judgeRoPoLLcommittee at3838B total parameters beats Mistral\-Large\-3 \(675675B\) by1\.31×1\.31\\timeson HelpSteer 2 under30%30\\%bimodal\-randomcorruption \(an18×18\\timesparameter advantage, §[6\.3](https://arxiv.org/html/2606.30931#S6.SS3)\)\. A Noisy\-GT control \(§[6\.7](https://arxiv.org/html/2606.30931#S6.SS7)\) rules out the obvious confound that theRoPoLLpremium is paid against benign Gaussian imprecision rather than against biased contamination\.
- •Open release of the judge\-output corpus\.†\\dagger†\\dagger†\\daggerDataset released at[https://github\.com/aws/RoPoLL](https://github.com/aws/RoPoLL)\.We release the full1313\-judge×\\timesthree\-benchmark output corpus—approximately28​K28\\mathrm\{K\}scored\(judge,sample\)\(\\text\{judge\},\\text\{sample\}\)cells of parsed attribute scores, per\-call latencies, and reference labels underlying every figure in §[6](https://arxiv.org/html/2606.30931#S6)\(§[6\.8](https://arxiv.org/html/2606.30931#S6.SS8)\)\. To our knowledge this is the first standardised corpus of LLM\-jury outputs; follow\-up work on judge calibration, alternative aggregators, or new corruption families can be benchmarked against this fixed substrate without re\-running the inference cost\.

#### Paper organisation\.

§[3](https://arxiv.org/html/2606.30931#S3)formalises the problem setup, including the LLM Jury \(Definitions[4](https://arxiv.org/html/2606.30931#Thmdefinition4)–[5](https://arxiv.org/html/2606.30931#Thmdefinition5)\), the Huber contamination model \(Assumption[2](https://arxiv.org/html/2606.30931#Thmassumption2), with the empirical natural\-failure\-rate calibration of[Figure˜2](https://arxiv.org/html/2606.30931#S3.F2)\), and the unbounded\-bias result forPoLL\(Proposition[2](https://arxiv.org/html/2606.30931#Thmproposition2)\)\. §[4](https://arxiv.org/html/2606.30931#S4)develops theRoPoLLmethodology: the choice of geometric median over coordinate\-wise median and trimmed mean \(§[4\.1](https://arxiv.org/html/2606.30931#S4.SS1)\), structural properties of GM \(Proposition[3](https://arxiv.org/html/2606.30931#Thmproposition3)\), and the Weiszfeld iteration \(Algorithm[1](https://arxiv.org/html/2606.30931#alg1)\)\. §[5](https://arxiv.org/html/2606.30931#S5)states the finite\-sample upper bound \(Theorem[1](https://arxiv.org/html/2606.30931#Thmtheorem1)\), its correlated\-jury extension \(Lemma[3](https://arxiv.org/html/2606.30931#Thmlemma3)\), and the matching minimax lower bound \(Theorem[2](https://arxiv.org/html/2606.30931#Thmtheorem2)\)\. §[6](https://arxiv.org/html/2606.30931#S6)presents the benchmark evaluation organised by corruption type; §[2](https://arxiv.org/html/2606.30931#S2)situates the work in the LLM\-as\-Judge, robust\-statistics, and Byzantine\-distributed\-learning literatures; §[7](https://arxiv.org/html/2606.30931#S7)concludes with scope, limitations, and follow\-up directions\. The released corpus and its inter\-judge correlation structure, including the empiricalγ¯W\\bar\{\\gamma\}\_\{W\}measurement, are documented in §[6](https://arxiv.org/html/2606.30931#S6)\. Full proofs and a 2D synthetic visualisation gallery are deferred to Appendices[A](https://arxiv.org/html/2606.30931#A1)–[B\.1](https://arxiv.org/html/2606.30931#A2.SS1)\.

## 2Related Work

LLM\-as\-Judge evaluation and per\-judge biases\.The LLM\-as\-Judge paradigm was established byZhenget al\.\([2023](https://arxiv.org/html/2606.30931#bib.bib1)\)\(MT\-Bench, Chatbot Arena\), demonstrating that strong models such as GPT\-4 can serve as reliable proxies for human annotators\. Subsequent work has extended the paradigm along several axes: open\-source judges with fine\-grained rubrics\(Kimet al\.,[2024](https://arxiv.org/html/2606.30931#bib.bib7)\); automated frameworks for instruction\-following models\(Liet al\.,[2023](https://arxiv.org/html/2606.30931#bib.bib8); Duboiset al\.,[2024](https://arxiv.org/html/2606.30931#bib.bib9)\); and skill\-level evaluation\(Yeet al\.,[2024](https://arxiv.org/html/2606.30931#bib.bib10)\)\. A parallel literature documents systematic biases of single judges—position, verbosity, self\-enhancement, sycophancy, and prompt\-format sensitivity\(Wanget al\.,[2023](https://arxiv.org/html/2606.30931#bib.bib6); Panicksseryet al\.,[2024](https://arxiv.org/html/2606.30931#bib.bib2); Saitoet al\.,[2023](https://arxiv.org/html/2606.30931#bib.bib3); Stureborget al\.,[2024](https://arxiv.org/html/2606.30931#bib.bib4)\)\. These findings motivate the use of diverse judge panels but treat each judge in isolation; no prior work analyzes the*aggregation*step or its failure modes\.

Jury and panel evaluation\.Vergaet al\.\([2024](https://arxiv.org/html/2606.30931#bib.bib5)\)introduced the Panel of LLM Evaluators \(PoLL\), our direct predecessor: a diverse committee of smaller backbones aggregated by the arithmetic mean\. Their work established the practical value of LLM juries but did not analyze robustness; the mean aggregator is used without justification, and no failure modes are considered\.Zhanget al\.\([2024](https://arxiv.org/html/2606.30931#bib.bib14)\)studied how panel width and depth affect evaluation fairness, again without robustness guarantees\. The key gap across this literature is the absence of any analysis of catastrophic failure modes or formal robustness properties of the aggregation rule\. Our Proposition[2](https://arxiv.org/html/2606.30931#Thmproposition2)closes this gap: under any positive contamination ratePoLL\(Vergaet al\.,[2024](https://arxiv.org/html/2606.30931#bib.bib5)\)admits unbounded bias regardless ofNN\.

Multi\-agent debate and structured aggregation\.A distinct family of multi\-judge methods produces aggregated judgments through structured*interaction*rather than independent scoring\.Liet al\.\([2024](https://arxiv.org/html/2606.30931#bib.bib11)\)propose peer\-rank discussion among judges, in which each judge sees others’ scores and updates its own;Chanet al\.\([2024](https://arxiv.org/html/2606.30931#bib.bib12)\)propose multi\-agent debate, in which judges argue over a verdict before consensus\. These methods change the joint distribution of\(𝐲^1,…,𝐲^N\)\(\\hat\{\{\\mathbf\{y\}\}\}\_\{1\},\\ldots,\\hat\{\{\\mathbf\{y\}\}\}\_\{N\}\)—they introduce dependence by design, breaking Assumption[3](https://arxiv.org/html/2606.30931#Thmassumption3)—and trade independence for deliberation\-driven error reduction\. Whether they exhibit the same Byzantine\-failure mode asPoLLis an open question\. The Huber\-contamination analysis of this paper does not directly apply to such interactive aggregators, but the corruption\-class diagnosis \(point masses far from the truth\) likely transfers, suggesting robust extensions of debate\-based aggregation as a future direction\. Majority voting in mathematical reasoning\(Cobbeet al\.,[2021](https://arxiv.org/html/2606.30931#bib.bib13)\)is a related but coarser ensemble technique on binary correctness; the analogue of Proposition[2](https://arxiv.org/html/2606.30931#Thmproposition2)for vote\-based aggregation on\{0,1\}\\\{0,1\\\}outputs is the standardα<1/2\\alpha<1/2Byzantine threshold\.

Calibration as a complementary paradigm\.A separate line of work removes judge bias*at the source*via per\-judge calibration on a labeled validation slice\(Zhenget al\.,[2023](https://arxiv.org/html/2606.30931#bib.bib1)\)\. Calibration assumes a stationary, recoverable bias and trades worst\-case guarantees for average\-case efficiency;RoPoLLassumes nothing on the corruption distribution and pays a constant\-factor insurance premium to bound the worst case\. The two are complementary:RoPoLLcan aggregate calibrated scores, and the calibration\-RoPoLL composition—together with extensions to heterogeneous, correlated, and dependent juries—is left to future work\.

Robust statistics and the geometric median\.The Huber contamination model\(Huber,[1964](https://arxiv.org/html/2606.30931#bib.bib31)\)and the breakdown point\(Tukey,[1960](https://arxiv.org/html/2606.30931#bib.bib15)\)are the classical framework for estimation under arbitrary corruption\. The geometric median attains the optimal1/21/2breakdown for any translation\-equivariant estimator\(Lopuhaä and Rousseeuw,[1991](https://arxiv.org/html/2606.30931#bib.bib26); Small,[1990](https://arxiv.org/html/2606.30931#bib.bib27); Vardi and Zhang,[2000](https://arxiv.org/html/2606.30931#bib.bib28)\); in high dimensions,Minsker \([2015](https://arxiv.org/html/2606.30931#bib.bib30)\)established sub\-Gaussian concentration for the geometric median of means—the result Theorem[1](https://arxiv.org/html/2606.30931#Thmtheorem1)adapts to contaminated juries—andLugosi and Mendelson \([2019](https://arxiv.org/html/2606.30931#bib.bib16)\)developed sub\-Gaussian mean estimators with optimal dimension dependence\. Recent applications to ML pipelines include block\-coordinate GM descent for robust training\(Acharyaet al\.,[2022](https://arxiv.org/html/2606.30931#bib.bib33)\)and GM Matching for robust subset selection\(Acharyaet al\.,[2025](https://arxiv.org/html/2606.30931#bib.bib32)\);Acharya \([2025](https://arxiv.org/html/2606.30931#bib.bib34)\)surveys robust learning from noisy data\. Our setting differs from this literature on three axes:*\(i\) low dimension*\(d∈\{4,5\}d\\in\\\{4,5\\\}evaluation attributes, so thed/N\\sqrt\{d/N\}rate is dominated by constants and the1/\(1−2​α\)1/\(1\-2\\alpha\)contamination factor is the load\-bearing dependence\);*\(ii\) structured contamination*\(QiQ\_\{i\}arises from specific LLM failure modes—parser fallback, sycophancy, refusals, cross\-attribute confusion—which inform the four empirical corruption types in §[6](https://arxiv.org/html/2606.30931#S6)\); and*\(iii\) heterogeneous workers*\(per\-judgeσi,αi\\sigma\_\{i\},\\alpha\_\{i\}vary across the panel, outside the i\.i\.d\. regime that the classical robust\-statistics literature targets\)\. Among broader alternatives in the robust\-aggregation toolbox, the*half\-space \(Tukey\) median*attains the optimal breakdown1/21/2in any dimension but is NP\-hard to compute and prohibitive atd≥5d\\geq 5\(Small,[1990](https://arxiv.org/html/2606.30931#bib.bib27)\);*median of means*\(Lugosi and Mendelson,[2019](https://arxiv.org/html/2606.30931#bib.bib16)\)targets heavy\-tailed data rather than Huber contamination concentrated in a minority of judges; the geometric median’s tuning\-free1/21/2breakdown, joint\-distance objective, andO​\(N​d​log⁡\(1/ϵ\)\)O\(Nd\\log\(1/\{\\epsilon\}\)\)cost make it the right default for the small\-dd, small\-NN, heterogeneous\-worker, one\-shot regime that LLM juries occupy\. A systematic empirical comparison against the broader family is left to future work \(§[7](https://arxiv.org/html/2606.30931#S7)\)\.

Byzantine\-robust distributed learning\.The connection between robust aggregation and Byzantine fault tolerance has been worked out in distributed optimization: Krum\(Blanchardet al\.,[2017](https://arxiv.org/html/2606.30931#bib.bib17)\), coordinate\-wise median and trimmed mean as gradient aggregators\(Yinet al\.,[2018](https://arxiv.org/html/2606.30931#bib.bib18)\), and Bulyan\(El Mhamdiet al\.,[2018](https://arxiv.org/html/2606.30931#bib.bib19)\)\. This literature targetsNNfrom tens to thousands of workers, with adversarial perturbations composed across thousands of training rounds\. The LLM\-jury setting shares the mathematical structure but differs operationally on three axes:*\(a\) smallNN*\(juries operate atN∈\{3,…,13\}N\\in\\\{3,\\dots,13\\\}where every judge is materially expensive, requiring tight finite\-sample guarantees\);*\(b\) per\-sample heterogeneity*\(the contamination indicatorZiZ\_\{i\}is conditional on the prompt\-response pairxx, not per round\);*\(c\) no iterative learning loop*\(LLM\-jury aggregation is one\-shot at evaluation time, so the per\-instance bias bound matters directly rather than its cumulative effect across rounds\)\. These differences explain why our analysis emphasizes finite\-sample distribution\-free guarantees over the corruption class \(Theorem[1](https://arxiv.org/html/2606.30931#Thmtheorem1)\); the heterogeneity of the worker pool, judge correlation, and explicit dependence \(in debate\-based methods\) are left to future work and have no direct analogue in the Byzantine distributed\-learning literature\.

To our knowledge, we are the first to formalize LLM jury aggregation as a robust estimation problem, prove finite\-sample contamination guarantees in this setting, and evaluate robustness systematically against both natural and adversarial judge failures at scale\.

## 3Problem Setup

We evaluate a system agentℳ:𝒫→ℛ\{\\mathcal\{M\}\}:\{\\mathcal\{P\}\}\\to\{\\mathcal\{R\}\}that maps prompts to responses\. For each evaluation instancex=\(p,r\)∈𝒳≜𝒫×ℛx=\(p,r\)\\in\{\\mathcal\{X\}\}\\triangleq\{\\mathcal\{P\}\}\\times\{\\mathcal\{R\}\}the goal is to estimate a vector of attribute scores describing how good the responserris for the promptpp\.

### 3\.1System Agent and Reward Space

Let𝒫\{\\mathcal\{P\}\}andℛ\{\\mathcal\{R\}\}denote the spaces of admissible natural\-language prompts and responses, and define the*instance space*𝒳≜𝒫×ℛ\{\\mathcal\{X\}\}\\triangleq\{\\mathcal\{P\}\}\\times\{\\mathcal\{R\}\}\. The model under evaluation is the*system agent*ℳ:𝒫→ℛ\{\\mathcal\{M\}\}:\{\\mathcal\{P\}\}\\to\{\\mathcal\{R\}\},p↦ℳ​\(p\)p\\mapsto\{\\mathcal\{M\}\}\(p\)\. Given a promptpp, the realized response isr=ℳ​\(p\)r=\{\\mathcal\{M\}\}\(p\)and the evaluation instance is\(p,r\)∈𝒳\(p,r\)\\in\{\\mathcal\{X\}\}\. Any stochasticity in the underlying generation procedure is immaterial for the development below, which is carried out conditional on the realized pair\(p,r\)\(p,r\)\.

###### Definition 1\(Reward\)\.

Fixd∈ℕd\\in\\mathbb\{N\}and write\[d\]≜\{1,…,d\}\[d\]\\triangleq\\\{1,\\ldots,d\\\}\. For eachk∈\[d\]k\\in\[d\], let𝒴\(k\)\{\\mathcal\{Y\}\}^\{\(k\)\}be a measurable space encoding the admissible judgements for attributekk\. The*reward space*is the Cartesian product𝒴≜∏k=1d𝒴\(k\)\{\\mathcal\{Y\}\}\\triangleq\\prod\_\{k=1\}^\{d\}\{\\mathcal\{Y\}\}^\{\(k\)\}, and a*reward*associated with\(p,r\)∈𝒳\(p,r\)\\in\{\\mathcal\{X\}\}is a vector𝐲=\(y\(1\),…,y\(d\)\)∈𝒴\{\\mathbf\{y\}\}=\(y^\{\(1\)\},\\ldots,y^\{\(d\)\}\)\\in\{\\mathcal\{Y\}\}wherey\(k\)∈𝒴\(k\)y^\{\(k\)\}\\in\{\\mathcal\{Y\}\}^\{\(k\)\}records the judgement ofrron attributekk\.

Definition[1](https://arxiv.org/html/2606.30931#Thmdefinition1)does not impose a common structure across the coordinate spaces, and typical instantiations include bounded scalars \(𝒴\(k\)=\[0,Kk\]\{\\mathcal\{Y\}\}^\{\(k\)\}=\[0,K\_\{k\}\]\), categorical or ordinal labels \(𝒴\(k\)=\{c1,…,cL\}\{\\mathcal\{Y\}\}^\{\(k\)\}=\\\{c\_\{1\},\\ldots,c\_\{L\}\\\}\), and free\-form text \(𝒴\(k\)=ℛ\{\\mathcal\{Y\}\}^\{\(k\)\}=\{\\mathcal\{R\}\}\)\. For ease of exposition we specialize throughout the paper to the*homogeneous bounded\-scalar*setting: there existsK\>0K\>0with𝒴\(k\)=\[0,K\]\{\\mathcal\{Y\}\}^\{\(k\)\}=\[0,K\]for everyk∈\[d\]k\\in\[d\], so

𝒴=\[0,K\]d⊂ℝd\.\{\\mathcal\{Y\}\}\\;=\\;\[0,K\]^\{d\}\\;\\subset\\;\\mathbb\{R\}^\{d\}\.\(1\)
###### Assumption 1\(Latent Reward Functional\)\.

Under \([1](https://arxiv.org/html/2606.30931#S3.E1)\) there exists a measurable map

𝐲⋆:𝒳→\[0,K\]d,𝐲⋆​\(x\)=\(y⋆\(1\)​\(x\),…,y⋆\(d\)​\(x\)\),\{\\mathbf\{y\}\}^\{\\star\}:\{\\mathcal\{X\}\}\\to\[0,K\]^\{d\},\\qquad\{\\mathbf\{y\}\}^\{\\star\}\(x\)=\\big\(y^\{\\star\(1\)\}\(x\),\\ldots,y^\{\\star\(d\)\}\(x\)\\big\),\(2\)called the*latent reward functional*, such that𝐲⋆​\(x\)\{\\mathbf\{y\}\}^\{\\star\}\(x\)is the canonical attribute\-wise assessment of responserrto promptppunder the reference evaluation protocol \(Definition[2](https://arxiv.org/html/2606.30931#Thmdefinition2)\)\. The componentsy⋆\(k\)​\(x\)∈\[0,K\]y^\{\\star\(k\)\}\(x\)\\in\[0,K\]are unobservable\.

### 3\.2Reference Protocol, Rubric, and Parser

Because𝐲⋆\{\\mathbf\{y\}\}^\{\\star\}is unobservable, evaluation must proceed through an observable reference protocol\.

###### Definition 2\(Reference Protocol\)\.

A*reference protocol*is a Markov kernel from𝒳\{\\mathcal\{X\}\}to\[0,K\]d\[0,K\]^\{d\}\(Billingsley,[1995](https://arxiv.org/html/2606.30931#bib.bib22); Dudley,[2002](https://arxiv.org/html/2606.30931#bib.bib23); Kallenberg,[2002](https://arxiv.org/html/2606.30931#bib.bib24)\):𝒜:𝒳↝\[0,K\]d\\mathcal\{A\}:\{\\mathcal\{X\}\}\\rightsquigarrow\[0,K\]^\{d\}, meaning that for eachx∈𝒳x\\in\{\\mathcal\{X\}\},𝒜\(⋅∣x\)\\mathcal\{A\}\(\\cdot\\mid x\)is a probability measure on\[0,K\]d\[0,K\]^\{d\}and, for each Borel setB⊆\[0,K\]dB\\subseteq\[0,K\]^\{d\}, the mapx↦𝒜​\(B∣x\)x\\mapsto\\mathcal\{A\}\(B\\mid x\)is measurable\. We interpret𝒜\(⋅∣x\)\\mathcal\{A\}\(\\cdot\\mid x\)as the distribution of the reference label assigned toxx\. Given evaluation instancesx1,…,xM∈𝒳x\_\{1\},\\ldots,x\_\{M\}\\in\{\\mathcal\{X\}\}withxj=\(pj,rj\)x\_\{j\}=\(p\_\{j\},r\_\{j\}\), the corresponding benchmark dataset is

𝒟=\{\(xj,𝐲jref\)\}j=1M,𝐲jref∼𝒜\(⋅∣xj\)\.\{\\mathcal\{D\}\}=\\\{\(x\_\{j\},\{\\mathbf\{y\}\}\_\{j\}^\{\\mathrm\{ref\}\}\)\\\}\_\{j=1\}^\{M\},\\qquad\{\\mathbf\{y\}\}\_\{j\}^\{\\mathrm\{ref\}\}\\sim\\mathcal\{A\}\(\\cdot\\mid x\_\{j\}\)\.\(3\)The protocol𝒜\\mathcal\{A\}may encode expert human annotation, an aggregation of multiple human judgements, or a designated reference model\. In the noiseless idealization𝒜\(⋅∣x\)=δ𝐲⋆​\(x\)\\mathcal\{A\}\(\\cdot\\mid x\)=\\delta\_\{\{\\mathbf\{y\}\}^\{\\star\}\(x\)\}, so𝐲jref=𝐲⋆​\(xj\)\{\\mathbf\{y\}\}\_\{j\}^\{\\mathrm\{ref\}\}=\{\\mathbf\{y\}\}^\{\\star\}\(x\_\{j\}\)for everyj∈\[M\]j\\in\[M\]\. The reference labels are used only for evaluation and are not available to the predictors under study\.

###### Definition 3\(Rubric\)\.

A*rubric*is a natural\-language specificationρ∈𝒫\\rho\\in\{\\mathcal\{P\}\}that fixes: \(i\) the collection ofddevaluation attributes and their semantics; \(ii\) the score range\[0,K\]\[0,K\]associated with each attribute; and \(iii\) the output schema from which scores are extracted\. Associated withρ\\rhois a deterministic encoding mapencρ:𝒳→𝒫\\operatorname\{enc\}\_\{\\rho\}:\{\\mathcal\{X\}\}\\to\{\\mathcal\{P\}\}, which serializes an evaluation instancex=\(p,r\)x=\(p,r\)into the prompt presented to the judging model\.

###### Definition 4\(LLM\-As\-Judge\)\.

An*LLM judge*is a tripletf=\(ℳf,ρ,ϕ\)f=\(\{\\mathcal\{M\}\}\_\{f\},\\,\\rho,\\,\\phi\), where \(i\)ℳf:𝒫↝ℛ\{\\mathcal\{M\}\}\_\{f\}:\{\\mathcal\{P\}\}\\rightsquigarrow\{\\mathcal\{R\}\}is a backbone language model viewed as a Markov kernel from prompts to raw textual outputs; \(ii\)ρ\\rhois a rubric \(Definition[3](https://arxiv.org/html/2606.30931#Thmdefinition3)\); and \(iii\)ϕ:ℛ→ℝd\\phi:\{\\mathcal\{R\}\}\\to\\mathbb\{R\}^\{d\}is a measurable deterministic parser that extracts a score vector from the raw text\. For an evaluation instancex∈𝒳x\\in\{\\mathcal\{X\}\}, the induced pipeline is

x→encρencρ⁡\(x\)→ℳfTf→ϕ𝐲^f​\(x\)∈ℝd,x\\;\\xrightarrow\{\\;\\operatorname\{enc\}\_\{\\rho\}\\;\}\\;\\operatorname\{enc\}\_\{\\rho\}\(x\)\\;\\xrightarrow\{\\;\{\\mathcal\{M\}\}\_\{f\}\\;\}\\;T\_\{f\}\\;\\xrightarrow\{\\;\\phi\\;\}\\;\\hat\{\{\\mathbf\{y\}\}\}\_\{f\}\(x\)\\;\\in\\;\\mathbb\{R\}^\{d\},\(4\)whereTf∼ℳf\(⋅∣encρ\(x\)\)T\_\{f\}\\sim\{\\mathcal\{M\}\}\_\{f\}\(\\,\\cdot\\mid\\operatorname\{enc\}\_\{\\rho\}\(x\)\)and𝐲^f​\(x\)=ϕ​\(Tf\)\\hat\{\{\\mathbf\{y\}\}\}\_\{f\}\(x\)=\\phi\(T\_\{f\}\)\. Equivalently,ffinduces a Markov kernelf:𝒳↝ℝdf:\{\\mathcal\{X\}\}\\rightsquigarrow\\mathbb\{R\}^\{d\}viaf​\(B∣x\)=ℳf​\(\{t∈ℛ:ϕ​\(t\)∈B\}∣encρ⁡\(x\)\)f\(B\\mid x\)=\{\\mathcal\{M\}\}\_\{f\}\\\!\\big\(\\\{t\\in\{\\mathcal\{R\}\}:\\phi\(t\)\\in B\\\}\\mid\\operatorname\{enc\}\_\{\\rho\}\(x\)\\big\)for every Borel setB⊆ℝdB\\subseteq\\mathbb\{R\}^\{d\}\.

### 3\.3LLM Jury and Aggregation Function

###### Definition 5\(LLM Jury\)\.

A*jury*is a finite collection ofNNLLM judges𝒥=\{f1,…,fN\}\{\\mathcal\{J\}\}=\\\{f\_\{1\},\\ldots,f\_\{N\}\\\}sharing a common rubricρ\\rhoand parserϕ\\phibut employing distinct backbones\{ℳfi\}i=1N\\\{\{\\mathcal\{M\}\}\_\{f\_\{i\}\}\\\}\_\{i=1\}^\{N\}\. On instancexx, the jury produces score vectors\{𝐲^1,…,𝐲^N\}⊂ℝd\\\{\\hat\{\{\\mathbf\{y\}\}\}\_\{1\},\\ldots,\\hat\{\{\\mathbf\{y\}\}\}\_\{N\}\\\}\\subset\\mathbb\{R\}^\{d\}\.

###### Definition 6\(Aggregation Function\)\.

An*aggregation function*is a measurable map𝒜:\(ℝd\)N→ℝd\{\\mathcal\{A\}\}:\(\\mathbb\{R\}^\{d\}\)^\{N\}\\to\\mathbb\{R\}^\{d\}producing a consensus estimate𝐲^agg=𝒜​\(𝐲^1,…,𝐲^N\)\\hat\{\{\\mathbf\{y\}\}\}\_\{\\mathrm\{agg\}\}=\{\\mathcal\{A\}\}\(\\hat\{\{\\mathbf\{y\}\}\}\_\{1\},\\ldots,\\hat\{\{\\mathbf\{y\}\}\}\_\{N\}\)\. The objective is to minimize‖𝐲^agg−𝐲⋆‖2\\\|\\hat\{\{\\mathbf\{y\}\}\}\_\{\\mathrm\{agg\}\}\-\{\\mathbf\{y\}\}^\{\\star\}\\\|\_\{2\}uniformly over the evaluation distribution\.

The central question of this work is:*which𝒜\{\\mathcal\{A\}\}remains accurate when judges fail in arbitrary, possibly adversarial ways?*To answer it formally, we adopt the classical contamination model from robust statistics\.

### 3\.4Huber Contamination Model and Companion Assumptions

###### Assumption 2\(Huberϵ\{\\epsilon\}\-Contamination Model\)\.

Each judgefi∈𝒥f\_\{i\}\\in\{\\mathcal\{J\}\}has a contamination rateαi∈\[0,1\)\\alpha\_\{i\}\\in\[0,1\), and the conditional law of𝐲^i\\hat\{\{\\mathbf\{y\}\}\}\_\{i\}given𝐲⋆\{\\mathbf\{y\}\}^\{\\star\}is the mixture

𝐲^i∼\(1−αi\)​Pi\+αi​Qi,\\hat\{\{\\mathbf\{y\}\}\}\_\{i\}\\,\\sim\\,\(1\-\\alpha\_\{i\}\)\\,P\_\{i\}\+\\alpha\_\{i\}\\,Q\_\{i\},\(5\)where the*competent*componentPiP\_\{i\}is unbiased, with𝔼Pi​\[𝐲^i\]=𝐲⋆\\mathbb\{E\}\_\{P\_\{i\}\}\[\\hat\{\{\\mathbf\{y\}\}\}\_\{i\}\]=\{\\mathbf\{y\}\}^\{\\star\}and finite second moment, and the*corruption*componentQiQ\_\{i\}is an arbitrary distribution onℝd\\mathbb\{R\}^\{d\}\. At each evaluation an indicatorZi∼Bernoulli​\(αi\)Z\_\{i\}\\sim\\mathrm\{Bernoulli\}\(\\alpha\_\{i\}\)selects which component generates𝐲^i\\hat\{\{\\mathbf\{y\}\}\}\_\{i\}\.

#### Concrete instantiations ofQiQ\_\{i\}\.

The unrestrictedQiQ\_\{i\}admits, as special cases, every LLM\-judge failure mode reported in the single\-judge bias literature:*mode collapse*\(Qi=δ𝟎Q\_\{i\}=\\delta\_\{\{\\mathbf\{0\}\}\}, the parser\-fallback vector emitted on malformed JSON or safety refusals\);*sycophancy*\(Qi=δK⋅𝟏Q\_\{i\}=\\delta\_\{K\\cdot\{\\mathbf\{1\}\}\}, near\-maximum scores assigned indiscriminately,Wanget al\.,[2023](https://arxiv.org/html/2606.30931#bib.bib6); Stureborget al\.,[2024](https://arxiv.org/html/2606.30931#bib.bib4)\);*anti\-correlated Byzantine attacks*\(Qi=δK​𝟏−𝐲⋆Q\_\{i\}=\\delta\_\{K\{\\mathbf\{1\}\}\-\{\\mathbf\{y\}\}^\{\\star\}\}, mirror\-image scores\);*cross\-attribute confusion*\(Qi=Unif​\{0,K\}dQ\_\{i\}=\\mathrm\{Unif\}\\\{0,K\\\}^\{d\}, each coordinate plausible per axis but jointly anomalous, matching the cross\-dimensional failure mode of Example[1](https://arxiv.org/html/2606.30931#Thmexample1)\); and*heavy\-tailed adversaries*\(QiQ\_\{i\}Cauchy or otherwise unbounded, modelling parser hallucinations of arbitrarily large scores\)\. The four synthetic regimes evaluated in §[6](https://arxiv.org/html/2606.30931#S6)\(zeros,inverted,bimodal\-random,cauchy\-far\) instantiate these fourQiQ\_\{i\}choices respectively;αi\\alpha\_\{i\}encodes the per\-judge unreliability and is expected to decrease with backbone capacity\.

#### Empirical grounding\.

Naturally\-occurring parser failures \(theQi=δ𝟎Q\_\{i\}=\\delta\_\{\{\\mathbf\{0\}\}\}instantiation above\) are not hypothetical: across our1313\-judge×\\timesbenchmark grid \([Figure˜2](https://arxiv.org/html/2606.30931#S3.F2)\), mean failure rates span0\.59%0\.59\\%on HelpSteer 2 and3\.38%3\.38\\%on HelpSteer 3, with the smallest judge \(Gemma\-4B\) failing on33%33\\%of HS 3 multilingual signed\-preference samples\. The deployment regime is therefore dataset\-dependent across one to two orders of magnitude inα\\alpha, and the distribution\-free contamination class\{Qi\}\\\{Q\_\{i\}\\\}is the right object of study\.

![Refer to caption](https://arxiv.org/html/2606.30931v1/x5.png)Figure 2:Naturally\-occurring parser\-failure rates motivate the contamination model\.Horizontal bars per judge \(sorted by parameter count, top = smallest\) restricted to the1313\-judge pool common to both benchmarks \(Claude\-Opus/Sonnet/Haiku\-4\.5 are HS 3\-only and excluded here for panel alignment; their HS 3 statistics appear in Table[2](https://arxiv.org/html/2606.30931#S6.T2)\)\. The natural failure regime is*dataset\-dependent*:0\.59%0\.59\\%mean on HelpSteer 2 and3\.38%3\.38\\%mean on HelpSteer 3—with the smallest judge \(Gemma\-4B\) failing on33%33\\%of HS 3 multilingual signed\-preference samples \(full1616\-judge pool\)\. Each parser\-failure event is a Dirac mass at the fallback vector𝟎\{\\mathbf\{0\}\}, instantiatingQ=δ𝟎Q=\\delta\_\{\{\\mathbf\{0\}\}\}in Assumption[2](https://arxiv.org/html/2606.30931#Thmassumption2)\(mode collapse\)\. Naturally\-occurring rates already span0%0\\%to33%33\\%, motivating the synthetic sweepr∈\[0%,50%\]r\\in\[0\\%,50\\%\]studied in §[6](https://arxiv.org/html/2606.30931#S6), which covers this natural regime and stress\-tests beyond\.###### Assumption 3\(Conditional Independence\)\.

Conditioned on𝐲⋆\{\\mathbf\{y\}\}^\{\\star\}, the judge outputs𝐲^1,…,𝐲^N\\hat\{\{\\mathbf\{y\}\}\}\_\{1\},\\ldots,\\hat\{\{\\mathbf\{y\}\}\}\_\{N\}are mutually independent\.

###### Assumption 4\(Sub\-Gaussian Competent Noise\)\.

For each judgefif\_\{i\}, the competent componentPiP\_\{i\}of Assumption[2](https://arxiv.org/html/2606.30931#Thmassumption2)isσi2\\sigma\_\{i\}^\{2\}\-sub\-Gaussian: for all𝐮∈𝕊d−1\{\\mathbf\{u\}\}\\in\\mathbb\{S\}^\{d\-1\},

𝔼Pi​\[exp⁡\(λ​𝐮⊤​\(𝐲^i−𝐲⋆\)\)\]≤exp⁡\(λ2​σi2/2\),∀λ∈ℝ\.\\mathbb\{E\}\_\{P\_\{i\}\}\\\!\\Big\[\\exp\\\!\\big\(\\lambda\\,\{\\mathbf\{u\}\}^\{\\top\}\(\\hat\{\{\\mathbf\{y\}\}\}\_\{i\}\-\{\\mathbf\{y\}\}^\{\\star\}\)\\big\)\\Big\]\\;\\leq\\;\\exp\\\!\\big\(\\lambda^\{2\}\\sigma\_\{i\}^\{2\}/2\\big\),\\qquad\\forall\\,\\lambda\\in\\mathbb\{R\}\.\(6\)The parameterσi2\\sigma\_\{i\}^\{2\}is the per\-judge*skill*parameter\.

###### Assumption 5\(Minority Corruption\)\.

The*effective contamination fraction*

α≜1N​∑i=1Nαi\\alpha\\;\\triangleq\\;\\frac\{1\}\{N\}\\sum\_\{i=1\}^\{N\}\\alpha\_\{i\}\(7\)satisfiesα<1/2\\alpha<1/2\.

### 3\.5Observation Model and Variance Reduction

Collecting the assumptions above, the complete observation model for a single evaluation instance is

𝐲^i=\(1−Zi\)\(𝐲⋆\+ϵi\)\+Zi𝜼i,i=1,…,N,\\boxed\{\\hat\{\{\\mathbf\{y\}\}\}\_\{i\}\\;=\\;\(1\-Z\_\{i\}\)\\,\(\{\\mathbf\{y\}\}^\{\\star\}\+\\bm\{\\epsilon\}\_\{i\}\)\\;\+\\;Z\_\{i\}\\,\\bm\{\\eta\}\_\{i\},\\qquad i=1,\\ldots,N,\}\(8\)whereZi∼Bernoulli​\(αi\)Z\_\{i\}\\sim\\mathrm\{Bernoulli\}\(\\alpha\_\{i\}\)are independent latent corruption indicators,ϵi∼Pi−𝐲⋆\\bm\{\\epsilon\}\_\{i\}\\sim P\_\{i\}\-\{\\mathbf\{y\}\}^\{\\star\}is zero\-mean andσi2\\sigma\_\{i\}^\{2\}\-sub\-Gaussian \(Assumption[4](https://arxiv.org/html/2606.30931#Thmassumption4)\), and𝜼i∼Qi\\bm\{\\eta\}\_\{i\}\\sim Q\_\{i\}is the arbitrary corruption noise, independent ofϵi\\bm\{\\epsilon\}\_\{i\}andZiZ\_\{i\}\. The statistician observes only\{𝐲^1,…,𝐲^N\}\\\{\\hat\{\{\\mathbf\{y\}\}\}\_\{1\},\\ldots,\\hat\{\{\\mathbf\{y\}\}\}\_\{N\}\\\}and has no access to\{Zi\}\\\{Z\_\{i\}\\\}or\{Qi\}\\\{Q\_\{i\}\\\}\.

The canonical jury aggregator is the arithmetic mean adopted byPoLL\(Vergaet al\.,[2024](https://arxiv.org/html/2606.30931#bib.bib5)\):

𝐲^mean≜1N​∑i=1N𝐲^i\.\\hat\{\{\\mathbf\{y\}\}\}\_\{\\mathrm\{mean\}\}\\;\\triangleq\\;\\frac\{1\}\{N\}\\sum\_\{i=1\}^\{N\}\\hat\{\{\\mathbf\{y\}\}\}\_\{i\}\.\(9\)On clean juries the mean enjoys the parametric variance\-reduction rate\.

###### Proposition 1\(Variance Reduction for the Clean Jury\)\.

Assumeαi=0\\alpha\_\{i\}=0for alli∈\[N\]i\\in\[N\], so every judge operates in the competent regime\. Then𝔼​\[𝐲^mean∣𝐲⋆\]=𝐲⋆\\mathbb\{E\}\[\\hat\{\{\\mathbf\{y\}\}\}\_\{\\mathrm\{mean\}\}\\mid\{\\mathbf\{y\}\}^\{\\star\}\]=\{\\mathbf\{y\}\}^\{\\star\}and

Cov​\(𝐲^mean∣𝐲⋆\)=1N2​∑i=1N∑j=1NCov​\(𝐲^i,𝐲^j∣𝐲⋆\)\.\\mathrm\{Cov\}\\\!\\left\(\\hat\{\{\\mathbf\{y\}\}\}\_\{\\mathrm\{mean\}\}\\mid\{\\mathbf\{y\}\}^\{\\star\}\\right\)\\;=\\;\\frac\{1\}\{N^\{2\}\}\\sum\_\{i=1\}^\{N\}\\sum\_\{j=1\}^\{N\}\\mathrm\{Cov\}\\\!\\left\(\\hat\{\{\\mathbf\{y\}\}\}\_\{i\},\\hat\{\{\\mathbf\{y\}\}\}\_\{j\}\\mid\{\\mathbf\{y\}\}^\{\\star\}\\right\)\.\(10\)Under Assumption[3](https://arxiv.org/html/2606.30931#Thmassumption3), the off\-diagonal terms vanish and

Cov\(𝐲^mean∣𝐲⋆\)=1N2∑i=1N𝚺i,𝔼\[∥𝐲^mean−𝐲⋆∥22\|𝐲⋆\]=1N2∑i=1Ntr\(𝚺i\)\.\\mathrm\{Cov\}\\\!\\left\(\\hat\{\{\\mathbf\{y\}\}\}\_\{\\mathrm\{mean\}\}\\mid\{\\mathbf\{y\}\}^\{\\star\}\\right\)\\;=\\;\\frac\{1\}\{N^\{2\}\}\\sum\_\{i=1\}^\{N\}\{\\mathbf\{\\Sigma\}\}\_\{i\},\\qquad\\mathbb\{E\}\\\!\\left\[\\left\\\|\\hat\{\{\\mathbf\{y\}\}\}\_\{\\mathrm\{mean\}\}\-\{\\mathbf\{y\}\}^\{\\star\}\\right\\\|\_\{2\}^\{2\}\\,\\middle\|\\,\{\\mathbf\{y\}\}^\{\\star\}\\right\]\\;=\\;\\frac\{1\}\{N^\{2\}\}\\sum\_\{i=1\}^\{N\}\\operatorname\{tr\}\(\{\\mathbf\{\\Sigma\}\}\_\{i\}\)\.\(11\)If𝚺i⪯σ2​𝐈d\{\\mathbf\{\\Sigma\}\}\_\{i\}\\preceq\\sigma^\{2\}\{\\mathbf\{I\}\}\_\{d\}uniformly, then𝔼\[∥𝐲^mean−𝐲⋆∥22\|𝐲⋆\]≤dσ2/N\\mathbb\{E\}\\\!\\left\[\\left\\\|\\hat\{\{\\mathbf\{y\}\}\}\_\{\\mathrm\{mean\}\}\-\{\\mathbf\{y\}\}^\{\\star\}\\right\\\|\_\{2\}^\{2\}\\,\\middle\|\\,\{\\mathbf\{y\}\}^\{\\star\}\\right\]\\leq d\\sigma^\{2\}/N\.

The proof is a direct application of linearity of expectation and bilinearity of covariance and is given in Appendix[A\.1](https://arxiv.org/html/2606.30931#A1.SS1)\.

###### Corollary 1\(Effective Jury Size Under Correlation\)\.

Assumeαi=0\\alpha\_\{i\}=0for alliiand that there exist𝚺⪰0\{\\mathbf\{\\Sigma\}\}\\succeq 0andγ∈\[−1/\(N−1\),1\]\\gamma\\in\[\-1/\(N\-1\),1\]withCov​\(𝐲^i∣𝐲⋆\)=𝚺\\mathrm\{Cov\}\(\\hat\{\{\\mathbf\{y\}\}\}\_\{i\}\\mid\{\\mathbf\{y\}\}^\{\\star\}\)=\{\\mathbf\{\\Sigma\}\}andCov​\(𝐲^i,𝐲^j∣𝐲⋆\)=γ​𝚺\\mathrm\{Cov\}\(\\hat\{\{\\mathbf\{y\}\}\}\_\{i\},\\hat\{\{\\mathbf\{y\}\}\}\_\{j\}\\mid\{\\mathbf\{y\}\}^\{\\star\}\)=\\gamma\\,\{\\mathbf\{\\Sigma\}\}fori≠ji\\neq j\. ThenCov​\(𝐲^mean∣𝐲⋆\)=1\+\(N−1\)​γN​𝚺\\mathrm\{Cov\}\(\\hat\{\{\\mathbf\{y\}\}\}\_\{\\mathrm\{mean\}\}\\mid\{\\mathbf\{y\}\}^\{\\star\}\)=\\tfrac\{1\+\(N\-1\)\\gamma\}\{N\}\\,\{\\mathbf\{\\Sigma\}\}and𝔼​\[‖𝐲^mean−𝐲⋆‖22∣𝐲⋆\]=1\+\(N−1\)​γN​tr⁡\(𝚺\)\\mathbb\{E\}\[\\\|\\hat\{\{\\mathbf\{y\}\}\}\_\{\\mathrm\{mean\}\}\-\{\\mathbf\{y\}\}^\{\\star\}\\\|\_\{2\}^\{2\}\\mid\{\\mathbf\{y\}\}^\{\\star\}\]=\\tfrac\{1\+\(N\-1\)\\gamma\}\{N\}\\,\\operatorname\{tr\}\(\{\\mathbf\{\\Sigma\}\}\)\. Defining the*effective jury size*Neff≜N/\(1\+\(N−1\)​γ\)N\_\{\\mathrm\{eff\}\}\\triangleq N/\(1\+\(N\-1\)\\gamma\), the MSE rate istr⁡\(𝚺\)/Neff\\operatorname\{tr\}\(\{\\mathbf\{\\Sigma\}\}\)/N\_\{\\mathrm\{eff\}\}\.

A controlled synthetic validation \([Figure˜7\(a\)](https://arxiv.org/html/2606.30931#S5.F7.sf1)of[Figure˜7](https://arxiv.org/html/2606.30931#S5.F7), §[5\.1](https://arxiv.org/html/2606.30931#S5.SS1)\) confirms that empirical MSE on an equicorrelated Gaussian jury matches the closed\-form prediction1\+\(N−1\)​γN​d​σ2\\tfrac\{1\+\(N\-1\)\\gamma\}\{N\}\\,d\\sigma^\{2\}across the full rangeγ∈\[0,0\.95\]\\gamma\\in\[0,0\.95\]\. The corollary has a direct implication for jury design: for anyγ\>0\\gamma\>0the effective jury sizeNeffN\_\{\\mathrm\{eff\}\}saturates at1/γ1/\\gamma, so adding more judges pastN≈1/γN\\approx 1/\\gammabuys essentially nothing\. Withγ\\gammain the moderate range\[0\.3,0\.5\]\[0\.3,0\.5\]characteristic of diverse but non\-orthogonal LLM backbones,NeffN\_\{\\mathrm\{eff\}\}saturates already atN≈2N\\approx 2–33, motivating the three\-judge committees throughout §[6](https://arxiv.org/html/2606.30931#S6)\.

### 3\.6Fragility ofPoLL

The next result shows that the1/N1/Nvariance\-reduction rate of Proposition[1](https://arxiv.org/html/2606.30931#Thmproposition1)is irrelevant the moment any contamination is present\.

###### Proposition 2\(Unbounded Bias ofPoLL\)\.

Under Assumption[2](https://arxiv.org/html/2606.30931#Thmassumption2), suppose eachQiQ\_\{i\}has finite first momentμiQ≜𝔼Qi​\[𝐲^i\]∈ℝd\{\\mathbf\{\\mu\}\}\_\{i\}^\{Q\}\\triangleq\\mathbb\{E\}\_\{Q\_\{i\}\}\[\\hat\{\{\\mathbf\{y\}\}\}\_\{i\}\]\\in\\mathbb\{R\}^\{d\}\. Then

𝔼​\[𝐲^mean∣𝐲⋆\]=𝐲⋆\+1N​∑i=1Nαi​\(μiQ−𝐲⋆\),\\mathbb\{E\}\\\!\\left\[\\hat\{\{\\mathbf\{y\}\}\}\_\{\\mathrm\{mean\}\}\\mid\{\\mathbf\{y\}\}^\{\\star\}\\right\]\\;=\\;\{\\mathbf\{y\}\}^\{\\star\}\\;\+\\;\\frac\{1\}\{N\}\\sum\_\{i=1\}^\{N\}\\alpha\_\{i\}\\\!\\left\(\{\\mathbf\{\\mu\}\}\_\{i\}^\{Q\}\-\{\\mathbf\{y\}\}^\{\\star\}\\right\),\(12\)and for anyα\>0\\alpha\>0the conditional bias𝔼​\[𝐲^mean∣𝐲⋆\]−𝐲⋆\\mathbb\{E\}\[\\hat\{\{\\mathbf\{y\}\}\}\_\{\\mathrm\{mean\}\}\\mid\{\\mathbf\{y\}\}^\{\\star\}\]\-\{\\mathbf\{y\}\}^\{\\star\}cannot be uniformly bounded under Assumption[2](https://arxiv.org/html/2606.30931#Thmassumption2), regardless ofNN\.

###### Proof sketch\.

The bias formula \([12](https://arxiv.org/html/2606.30931#S3.E12)\) is immediate from linearity of expectation and the per\-judge identity𝔼​\[𝐲^i∣𝐲⋆\]=\(1−αi\)​𝐲⋆\+αi​μiQ\\mathbb\{E\}\[\\hat\{\{\\mathbf\{y\}\}\}\_\{i\}\\mid\{\\mathbf\{y\}\}^\{\\star\}\]=\(1\-\\alpha\_\{i\}\)\{\\mathbf\{y\}\}^\{\\star\}\+\\alpha\_\{i\}\{\\mathbf\{\\mu\}\}\_\{i\}^\{Q\}\. For unboundedness, fix anyB\>0B\>0and any indexi0i\_\{0\}withαi0\>0\\alpha\_\{i\_\{0\}\}\>0\(which exists sinceα\>0\\alpha\>0\)\. ChooseQi0=δ𝐲⋆\+\(N​B/αi0\)​𝐞1Q\_\{i\_\{0\}\}=\\delta\_\{\{\\mathbf\{y\}\}^\{\\star\}\+\(NB/\\alpha\_\{i\_\{0\}\}\)\\,\{\\mathbf\{e\}\}\_\{1\}\}andQi=PiQ\_\{i\}=P\_\{i\}fori≠i0i\\neq i\_\{0\}\. Then \([12](https://arxiv.org/html/2606.30931#S3.E12)\) reduces toB​𝐞1B\\,\{\\mathbf\{e\}\}\_\{1\}, so the bias has Euclidean normBB; sinceBBis arbitrary, no constant depending only on\(α,N,d,σ\)\(\\alpha,N,d,\\sigma\)can bound the bias uniformly over\{Qi\}\\\{Q\_\{i\}\\\}\. The full proof is in Appendix[A\.2](https://arxiv.org/html/2606.30931#A1.SS2)\. ∎

Proposition[2](https://arxiv.org/html/2606.30931#Thmproposition2)is thecentral impossibilitymotivatingRoPoLL: variance reduction overNNjudges is irrelevant when the bias of the aggregator is unbounded over the corruption class\. The construction in the proof scales the corruption mean linearly withNN, exactly cancelling the1/N1/Naveraging—so increasing the jury size cannot fix the problem\. We therefore seek an aggregator that simultaneously \(i\) matches theO​\(σ​d/N\)O\(\\sigma\\sqrt\{d/N\}\)rate of the mean in the clean case and \(ii\) has bounded error under arbitrary contamination withα<1/2\\alpha<1/2\. The geometric median, introduced in §[4](https://arxiv.org/html/2606.30931#S4), achieves both\.

## 4Robust Panel of LLM Judges

Proposition[2](https://arxiv.org/html/2606.30931#Thmproposition2)forces us to abandon the arithmetic mean: under contamination its bias is unbounded over the corruption class regardless of jury sizeNN\. We therefore proposeRoPoLL, a drop\-in replacement for thePoLLaggregation step that swaps the arithmetic mean for a robust mean estimator\. The framework is agnostic to the choice of estimator; we instantiate it with the geometric median, motivated below\.

### 4\.1Choosing the Robust Estimator

Three classical robust mean estimators are natural candidates: the*coordinate\-wise median*\(CoMed\), the*trimmed mean*, and the*geometric median*\(GM\)\.

#### Coordinate\-wise median\.

The coordinate\-wise median applies the univariate median per dimension, solving the separable problem

𝐲^Med=arg​min𝐳∈ℝd​∑i=1N‖𝐳−𝐲^i‖1,\\hat\{\{\\mathbf\{y\}\}\}\_\{\\mathrm\{Med\}\}\\;=\\;\\operatorname\*\{arg\\,min\}\_\{\{\\mathbf\{z\}\}\\in\\mathbb\{R\}^\{d\}\}\\sum\_\{i=1\}^\{N\}\\\|\{\\mathbf\{z\}\}\-\\hat\{\{\\mathbf\{y\}\}\}\_\{i\}\\\|\_\{1\},\(13\)whosekk\-th coordinate is the univariate medianmedi​\(y^i\(k\)\)\\mathrm\{med\}\_\{i\}\(\\hat\{y\}\_\{i\}^\{\(k\)\}\)\. The geometric median operates on joint Euclidean distance instead\. The distinction matters when corruptions are structured across dimensions, as the following example illustrates\.

###### Example 1\(Cross\-Dimensional Corruption\)\.

Consider a jury evaluating on two attributes with ground truth𝐲⋆=\(2\.5,2\.5\)\{\\mathbf\{y\}\}^\{\\star\}=\(2\.5,2\.5\)on\[0,5\]2\[0,5\]^\{2\}\. Suppose a corrupted judge outputs𝐲^corr=\(0,5\)\\hat\{\{\\mathbf\{y\}\}\}\_\{\\mathrm\{corr\}\}=\(0,5\)\. Each coordinate individually lies in the plausible range\[0,5\]\[0,5\], so the coordinate\-wise median treats this as unremarkable per axis\. The joint displacement‖𝐲^corr−𝐲⋆‖2=12\.5≈3\.54\\\|\\hat\{\{\\mathbf\{y\}\}\}\_\{\\mathrm\{corr\}\}\-\{\\mathbf\{y\}\}^\{\\star\}\\\|\_\{2\}=\\sqrt\{12\.5\}\\approx 3\.54is large, however, and the geometric median correctly downweights the point \([Figure˜3](https://arxiv.org/html/2606.30931#S4.F3)\)\.

0KK0KKAttribute 1Attribute 2‖𝐲^corr−𝐲⋆‖2=12\.5≈3\.54\\\|\\hat\{\{\\mathbf\{y\}\}\}\_\{\\mathrm\{corr\}\}\\\!\-\\\!\{\\mathbf\{y\}\}^\{\\star\}\\\|\_\{2\}\\\!=\\\!\\sqrt\{12\.5\}\\\!\\approx\\\!3\.54y^corr\(1\)=0\\hat\{y\}\_\{\\mathrm\{corr\}\}^\{\(1\)\}\\\!=\\\!0y^corr\(2\)=K\\hat\{y\}\_\{\\mathrm\{corr\}\}^\{\(2\)\}\\\!=\\\!K𝐲⋆=\(2\.5,2\.5\)\{\\mathbf\{y\}\}^\{\\star\}=\(2\.5,2\.5\)CoMed:both coordsin\[0,K\]\[0,K\], no anomalyGM:jointℓ2\\ell\_\{2\}displacement large𝐲^corr=\(0,K\)\\hat\{\{\\mathbf\{y\}\}\}\_\{\\mathrm\{corr\}\}=\(0,K\)Figure 3:Cross\-dimensional corruption \(Example[1](https://arxiv.org/html/2606.30931#Thmexample1)\)\.Three competent judges \(blue dots\) cluster around the truth𝐲⋆=\(2\.5,2\.5\)\{\\mathbf\{y\}\}^\{\\star\}=\(2\.5,2\.5\)in the score box\[0,K\]2\[0,K\]^\{2\}withK=5K=5\. A corrupted judge outputs𝐲^corr=\(0,K\)\\hat\{\{\\mathbf\{y\}\}\}\_\{\\mathrm\{corr\}\}=\(0,K\):*each coordinate individually*lies in the plausible range\[0,K\]\[0,K\]\(red axis ticks\), so any*coordinate\-wise*estimator sees nothing anomalous on either axis\. Jointly, however, the corrupted vector lies atℓ2\\ell\_\{2\}distance12\.5≈3\.54\\sqrt\{12\.5\}\\approx 3\.54from𝐲⋆\{\\mathbf\{y\}\}^\{\\star\}\(red dashed arrow\), and the geometric median’s joint\-distance objective downweights it\. This is the qualitative reasonRoPoLLuses GM rather than CoMed; the empirical analogue at scale is thebimodal\-randomsweep of §[6\.3](https://arxiv.org/html/2606.30931#S6.SS3)\.The picture in Example[1](https://arxiv.org/html/2606.30931#Thmexample1)extends to a class of corruptions that are bounded per\-coordinate but jointly anomalous: random vertices of the score hypercube\{0,K\}d\\\{0,K\\\}^\{d\}, mixtures of extreme corner values, or any corruption whose marginals look plausible but whose joint structure is not\. The empiricalbimodal\-randomclass \(§[6\.3](https://arxiv.org/html/2606.30931#S6.SS3)\), in which each corrupted slot has each coordinate independently drawn from\{0,K\}\\\{0,K\\\}with equal probability, is the canonical instance: per\-coordinate the marginal is12​\(δ0\+δK\)\\frac\{1\}\{2\}\(\\delta\_\{0\}\+\\delta\_\{K\}\), indistinguishable from plausible scoring; jointly, the corrupted vector sits at a random hypercube corner, far from𝐲⋆\{\\mathbf\{y\}\}^\{\\star\}inℓ2\\ell\_\{2\}\. Because each coordinate\-wise estimator must commit per coordinate without seeing the joint pattern, its per\-coordinate bias isΩ​\(α\)\\Omega\(\\alpha\)on this class \(a one\-dimensional Le Cam two\-point argument under the symmetric corruption marginal,Huber,[1964](https://arxiv.org/html/2606.30931#bib.bib31), Thm\. 5\.1\), and the per\-coordinate errors compose inℓ2\\ell\_\{2\}with ad\\sqrt\{d\}factor;[Figure˜8](https://arxiv.org/html/2606.30931#S6.F8)\(and the §[6\.3](https://arxiv.org/html/2606.30931#S6.SS3)sweep\) is the empirical analogue\.

#### A note on the geometric median’s optimality\.

The geometric median we use is the polynomial\-time robust default at the small jury sizesN≤5N\\leq 5characteristic of LLM panels; it is*not*the theoretically optimal estimator at largeNN\. Geometric median\-of\-means\(Lugosi and Mendelson,[2019](https://arxiv.org/html/2606.30931#bib.bib16); Hopkins,[2020](https://arxiv.org/html/2606.30931#bib.bib43)\)achieves the parametric rateσ​d/N\\sigma\\sqrt\{d/N\}*and*a tighter breakdown\-floor scaling of orderσ​α\\sigma\\sqrt\{\\alpha\}by aggregating block means before applying the geometric median\. AtN≤5N\\leq 5, however, MoM degenerates:K=NK=Nblocks of size 1 gives plain GM, and any coarser blocking lacks per\-block concentration\. We therefore use plain GM throughout\.

#### Trimmed mean\.

Theβ\\beta\-trimmed mean discards theβ\\betafraction of points farthest from the sample mean and averages the remainder\. It requires choosingβ\\beta, which in turn requires knowledge of the contamination rateα\\alpha: ifβ<α\\beta<\\alpha, corrupted points survive trimming and the bias of Proposition[2](https://arxiv.org/html/2606.30931#Thmproposition2)returns; ifβ\>α\\beta\>\\alpha, competent points are discarded, inflating variance\.

#### Geometric median\.

The geometric median attains the same1/21/2breakdown as the trimmed mean, operates on*joint*Euclidean distance, and is*tuning\-free*—it requires no knowledge of the contamination rate\. We therefore instantiateRoPoLLwith the geometric median; empirical comparisons against CoMed and the trimmed mean are reported in §[6](https://arxiv.org/html/2606.30931#S6), with the head\-to\-head against the trimmed mean on heavy\-tailed corruption shown in[Figure˜1](https://arxiv.org/html/2606.30931#S1.F1)\.

### 4\.2The Geometric Median: Definition and Properties

###### Definition 7\(RoPoLLvia Geometric Median\)\.

Given jury outputs𝐲^1,…,𝐲^N∈ℝd\\hat\{\{\\mathbf\{y\}\}\}\_\{1\},\\ldots,\\hat\{\{\\mathbf\{y\}\}\}\_\{N\}\\in\\mathbb\{R\}^\{d\}, theRoPoLLestimate of𝐲⋆\{\\mathbf\{y\}\}^\{\\star\}is

𝐲^GM≜arg​min𝐳∈ℝd​∑i=1N‖𝐳−𝐲^i‖2\.\\hat\{\{\\mathbf\{y\}\}\}\_\{\\mathrm\{GM\}\}\\;\\triangleq\\;\\operatorname\*\{arg\\,min\}\_\{\{\\mathbf\{z\}\}\\in\\mathbb\{R\}^\{d\}\}\\sum\_\{i=1\}^\{N\}\\\|\{\\mathbf\{z\}\}\-\\hat\{\{\\mathbf\{y\}\}\}\_\{i\}\\\|\_\{2\}\.\(14\)

The geometric median has a long history in location theory dating to Fermat \(1643\) and Weber \(1909\); its modern robustness analysis is due toLopuhaä and Rousseeuw \([1991](https://arxiv.org/html/2606.30931#bib.bib26)\); Small \([1990](https://arxiv.org/html/2606.30931#bib.bib27)\); Vardi and Zhang \([2000](https://arxiv.org/html/2606.30931#bib.bib28)\); Acharyaet al\.\([2022](https://arxiv.org/html/2606.30931#bib.bib33),[2025](https://arxiv.org/html/2606.30931#bib.bib32)\)\. We collect the structural properties we will use\.

###### Definition 8\(Finite\-Sample Breakdown Point\)\.

For an estimatorT:\(ℝd\)N→ℝdT:\(\\mathbb\{R\}^\{d\}\)^\{N\}\\to\\mathbb\{R\}^\{d\}and a sample𝐲^1:N∈\(ℝd\)N\\hat\{\{\\mathbf\{y\}\}\}\_\{1:N\}\\in\(\\mathbb\{R\}^\{d\}\)^\{N\}, the*finite\-sample breakdown point*ofTTat𝐲^1:N\\hat\{\{\\mathbf\{y\}\}\}\_\{1:N\}is the smallest fractionm/Nm/Nsuch that there exists a corrupted sample𝐲^1:N′\\hat\{\{\\mathbf\{y\}\}\}^\{\\prime\}\_\{1:N\}differing from𝐲^1:N\\hat\{\{\\mathbf\{y\}\}\}\_\{1:N\}in at mostmmcoordinates for which‖T​\(𝐲^1:N′\)−T​\(𝐲^1:N\)‖2\\\|T\(\\hat\{\{\\mathbf\{y\}\}\}^\{\\prime\}\_\{1:N\}\)\-T\(\\hat\{\{\\mathbf\{y\}\}\}\_\{1:N\}\)\\\|\_\{2\}can be made arbitrarily large\(Lopuhaä and Rousseeuw,[1991](https://arxiv.org/html/2606.30931#bib.bib26)\)\.

###### Proposition 3\(Properties of the Geometric Median\)\.

Let𝐲^1,…,𝐲^N∈ℝd\\hat\{\{\\mathbf\{y\}\}\}\_\{1\},\\ldots,\\hat\{\{\\mathbf\{y\}\}\}\_\{N\}\\in\\mathbb\{R\}^\{d\}withN≥1N\\geq 1, and letF​\(𝐳\)=∑i=1N‖𝐳−𝐲^i‖2F\(\{\\mathbf\{z\}\}\)=\\sum\_\{i=1\}^\{N\}\\\|\{\\mathbf\{z\}\}\-\\hat\{\{\\mathbf\{y\}\}\}\_\{i\}\\\|\_\{2\}\.

1. 1\.Existence\.FFis continuous, convex, and coercive, so a minimizer exists\.
2. 2\.Uniqueness\.If𝐲^1,…,𝐲^N\\hat\{\{\\mathbf\{y\}\}\}\_\{1\},\\ldots,\\hat\{\{\\mathbf\{y\}\}\}\_\{N\}are not collinear, thenFFis strictly convex and the minimizer is unique\.
3. 3\.Affine equivariance\.For any orthogonal𝐔∈ℝd×d\{\\mathbf\{U\}\}\\in\\mathbb\{R\}^\{d\\times d\}and translation𝐛∈ℝd\{\\mathbf\{b\}\}\\in\\mathbb\{R\}^\{d\},GM​\(𝐔​𝐲^i\+𝐛\)=𝐔​GM​\(𝐲^i\)\+𝐛\\mathrm\{GM\}\(\{\\mathbf\{U\}\}\\hat\{\{\\mathbf\{y\}\}\}\_\{i\}\+\{\\mathbf\{b\}\}\)=\{\\mathbf\{U\}\}\\,\\mathrm\{GM\}\(\\hat\{\{\\mathbf\{y\}\}\}\_\{i\}\)\+\{\\mathbf\{b\}\}\.
4. 4\.Breakdown point\.The finite\-sample breakdown point isϵ⋆=⌈N/2⌉/N→1/2\{\\epsilon\}^\{\\star\}=\\lceil N/2\\rceil/N\\to 1/2asN→∞N\\to\\infty, which is optimal among translation\-equivariant estimators\(Lopuhaä and Rousseeuw,[1991](https://arxiv.org/html/2606.30931#bib.bib26)\)\.

###### Proof sketch\.

Existence follows from continuity, convexity, and coercivity ofFFvia Weierstrass\. Strict convexity holds whenever some data point lies off any given line, which is the non\-collinearity hypothesis\. Affine equivariance is a direct calculation using‖𝐔𝐮‖2=‖𝐮‖2\\\|\{\\mathbf\{U\}\}\{\\mathbf\{u\}\}\\\|\_\{2\}=\\\|\{\\mathbf\{u\}\}\\\|\_\{2\}\. For the breakdown point, a subgradient argument shows that fewer than⌈N/2⌉\\lceil N/2\\rceilcorrupted points cannot dominate the competent unit\-vector sum at infinity; tightness comes from placing⌈N/2⌉\\lceil N/2\\rceilpoints at a divergent location\. The full proof is in Appendix[A\.3](https://arxiv.org/html/2606.30931#A1.SS3)\. ∎

### 4\.3The Weiszfeld Iteration

The geometric median has no closed form ford≥2d\\geq 2\(Bajaj,[1988](https://arxiv.org/html/2606.30931#bib.bib35)\); we compute it via the modified Weiszfeld iteration\(Weiszfeld,[1937](https://arxiv.org/html/2606.30931#bib.bib29); Vardi and Zhang,[2000](https://arxiv.org/html/2606.30931#bib.bib28)\)\.

#### Derivation\.

At any non\-data point𝐳≠𝐲^i\{\\mathbf\{z\}\}\\neq\\hat\{\{\\mathbf\{y\}\}\}\_\{i\}\(for allii\), the gradient ofF​\(𝐳\)=∑i‖𝐳−𝐲^i‖2F\(\{\\mathbf\{z\}\}\)=\\sum\_\{i\}\\\|\{\\mathbf\{z\}\}\-\\hat\{\{\\mathbf\{y\}\}\}\_\{i\}\\\|\_\{2\}is∇F​\(𝐳\)=∑i=1N\(𝐳−𝐲^i\)/‖𝐳−𝐲^i‖2\\nabla F\(\{\\mathbf\{z\}\}\)=\\sum\_\{i=1\}^\{N\}\(\{\\mathbf\{z\}\}\-\\hat\{\{\\mathbf\{y\}\}\}\_\{i\}\)/\\\|\{\\mathbf\{z\}\}\-\\hat\{\{\\mathbf\{y\}\}\}\_\{i\}\\\|\_\{2\}\. Setting∇F​\(𝐳\)=𝟎\\nabla F\(\{\\mathbf\{z\}\}\)=\{\\mathbf\{0\}\}and rearranging gives the fixed\-point

𝐳=∑i=1N𝐲^i/‖𝐳−𝐲^i‖2∑i=1N1/‖𝐳−𝐲^i‖2\.\{\\mathbf\{z\}\}\\;=\\;\\frac\{\\sum\_\{i=1\}^\{N\}\\hat\{\{\\mathbf\{y\}\}\}\_\{i\}/\\\|\{\\mathbf\{z\}\}\-\\hat\{\{\\mathbf\{y\}\}\}\_\{i\}\\\|\_\{2\}\}\{\\sum\_\{i=1\}^\{N\}1/\\\|\{\\mathbf\{z\}\}\-\\hat\{\{\\mathbf\{y\}\}\}\_\{i\}\\\|\_\{2\}\}\.\(15\)A modified weight1/max⁡\(‖𝐳−𝐲^i‖2,η\)1/\\max\(\\\|\{\\mathbf\{z\}\}\-\\hat\{\{\\mathbf\{y\}\}\}\_\{i\}\\\|\_\{2\},\\eta\)for small stability parameterη\>0\\eta\>0handles the singularity when the iterate coincides with a data point\(Vardi and Zhang,[2000](https://arxiv.org/html/2606.30931#bib.bib28)\), yielding Algorithm[1](https://arxiv.org/html/2606.30931#alg1)\.

Algorithm 1RoPoLL0:Jury scores

𝐲^1,…,𝐲^N∈ℝd\\hat\{\{\\mathbf\{y\}\}\}\_\{1\},\\ldots,\\hat\{\{\\mathbf\{y\}\}\}\_\{N\}\\in\\mathbb\{R\}^\{d\}; tolerance

ϵ\>0\{\\epsilon\}\>0; stability

η\>0\\eta\>0
1:

𝐳\(0\)←1N​∑i=1N𝐲^i\{\\mathbf\{z\}\}^\{\(0\)\}\\leftarrow\\frac\{1\}\{N\}\\sum\_\{i=1\}^\{N\}\\hat\{\{\\mathbf\{y\}\}\}\_\{i\}
2:for

t=0,1,2,…t=0,1,2,\\ldotsdo

3:

wi\(t\)←1/max⁡\(‖𝐳\(t\)−𝐲^i‖2,η\)w\_\{i\}^\{\(t\)\}\\leftarrow 1/\\max\(\\\|\{\\mathbf\{z\}\}^\{\(t\)\}\-\\hat\{\{\\mathbf\{y\}\}\}\_\{i\}\\\|\_\{2\},\\,\\eta\)for each

ii
4:

𝐳\(t\+1\)←∑iwi\(t\)​𝐲^i/∑iwi\(t\)\{\\mathbf\{z\}\}^\{\(t\+1\)\}\\leftarrow\\sum\_\{i\}w\_\{i\}^\{\(t\)\}\\hat\{\{\\mathbf\{y\}\}\}\_\{i\}\\,\\big/\\,\\sum\_\{i\}w\_\{i\}^\{\(t\)\}
5:if

‖𝐳\(t\+1\)−𝐳\(t\)‖2<ϵ\\\|\{\\mathbf\{z\}\}^\{\(t\+1\)\}\-\{\\mathbf\{z\}\}^\{\(t\)\}\\\|\_\{2\}<\{\\epsilon\}then

6:break

7:endif

8:endfor

9:return

𝐲^GM←𝐳\(t\+1\)\\hat\{\{\\mathbf\{y\}\}\}\_\{\\mathrm\{GM\}\}\\leftarrow\{\\mathbf\{z\}\}^\{\(t\+1\)\}

Each iteration is a reweighted mean in which points far from the current consensus receive small weights, automatically downweighting corrupted judges\.

#### Convergence and cost\.

Vardi and Zhang \([2000](https://arxiv.org/html/2606.30931#bib.bib28)\)prove that the modified Weiszfeld iteration converges to the unique geometric median at a linear rate whenever the data are not collinear:‖𝐳\(t\)−𝐲^GM‖2≤ρt​‖𝐳\(0\)−𝐲^GM‖2\\\|\{\\mathbf\{z\}\}^\{\(t\)\}\-\\hat\{\{\\mathbf\{y\}\}\}\_\{\\mathrm\{GM\}\}\\\|\_\{2\}\\leq\\rho^\{t\}\\\|\{\\mathbf\{z\}\}^\{\(0\)\}\-\\hat\{\{\\mathbf\{y\}\}\}\_\{\\mathrm\{GM\}\}\\\|\_\{2\}for someρ∈\(0,1\)\\rho\\in\(0,1\)\. The number of iterations to reach toleranceϵ\{\\epsilon\}is thereforeO​\(log⁡\(1/ϵ\)\)O\(\\log\(1/\{\\epsilon\}\)\), and each iteration costsO​\(N​d\)O\(Nd\), giving total costO​\(N​d​log⁡\(1/ϵ\)\)O\(Nd\\log\(1/\{\\epsilon\}\)\)\. For a typical LLM jury \(N≤20N\\leq 20,d≤5d\\leq 5,ϵ=10−8\{\\epsilon\}=10^\{\-8\}\) this is microseconds on a modern processor—negligible relative to the seconds of GPU time per judge inference\. A full convergence analysis is in Appendix[A\.4](https://arxiv.org/html/2606.30931#A1.SS4)\.

𝐲⋆\{\\mathbf\{y\}\}^\{\\star\}𝐲^GM\\hat\{\{\\mathbf\{y\}\}\}\_\{\\mathrm\{GM\}\}ρ\\rhoCα\+β​ρC\_\{\\alpha\+\\beta\}\\,\\rhoclusterB¯​\(𝐲⋆,ρ\)\\overline\{B\}\(\{\\mathbf\{y\}\}^\{\\star\},\\rho\)≥\(1−α−β\)​N\\geq\(1\{\-\}\\alpha\{\-\}\\beta\)NptsGM envelopeB¯​\(𝐲⋆,Cα\+β​ρ\)\\overline\{B\}\(\{\\mathbf\{y\}\}^\{\\star\},C\_\{\\alpha\+\\beta\}\\rho\)Figure 4:Geometry of Theorem[1](https://arxiv.org/html/2606.30931#Thmtheorem1)\.Lemma[2](https://arxiv.org/html/2606.30931#Thmlemma2)guarantees that at least\(1−α−β\)​N\(1\{\-\}\\alpha\{\-\}\\beta\)Njudge outputs \(blue dots\) lie inside the*cluster ball*B¯​\(𝐲⋆,ρ\)\\overline\{B\}\(\{\\mathbf\{y\}\}^\{\\star\},\\rho\)of sub\-Gaussian radiusρ\\rho\(solid disk\)\. Lemma[1](https://arxiv.org/html/2606.30931#Thmlemma1)then forces the geometric median𝐲^GM\\hat\{\{\\mathbf\{y\}\}\}\_\{\\mathrm\{GM\}\}\(blue triangle\) to lie inside the*GM envelope*B¯​\(𝐲⋆,Cα\+β​ρ\)\\overline\{B\}\(\{\\mathbf\{y\}\}^\{\\star\},C\_\{\\alpha\+\\beta\}\\rho\)\(dashed disk\),*regardless of where the remaining\(α\+β\)​N\(\\alpha\{\+\}\\beta\)Ncorrupted points \(red×\\times\) are placed*—this is the distribution\-free breakdown property of the geometric median\. The two\-step composition is exactly Theorem[1](https://arxiv.org/html/2606.30931#Thmtheorem1)\.zzx∗x\_\{\*\}Δ=‖x∗−z‖2\\Delta=\\\|x\_\{\*\}\-z\\\|\_\{2\}rrγ\\gammasin⁡γ≤rΔ\\sin\\gamma\\leq\\dfrac\{r\}\{\\Delta\}≥\(1−α\)​k\\geq\(1\{\-\}\\alpha\)kpts inB¯​\(z,r\)\\overline\{B\}\(z,r\)visibility coneFigure 5:Geometric core of Lemma[1](https://arxiv.org/html/2606.30931#Thmlemma1)\.The contradiction hypothesisΔ≜‖x∗−z‖2\>Cα​r\\Delta\\triangleq\\\|x\_\{\*\}\-z\\\|\_\{2\}\>C\_\{\\alpha\}rplacesx∗x\_\{\*\}*outside*the cluster ballB¯​\(z,r\)\\overline\{B\}\(z,r\), so the ball subtends a cone of half\-angleγ\\gammaatx∗x\_\{\*\}withsin⁡γ=r/Δ\\sin\\gamma=r/\\Delta\(right\-angle at the tangent point shown\)\. Every cluster pointxj∈B¯​\(z,r\)x\_\{j\}\\in\\overline\{B\}\(z,r\)lies inside this cone, hence makes angleγj≤γ\\gamma\_\{j\}\\leq\\gammawith the central rayx∗→zx\_\{\*\}\\to z, socos⁡γj≥1−r2/Δ2=α/\(1−α\)\\cos\\gamma\_\{j\}\\geq\\sqrt\{1\-r^\{2\}/\\Delta^\{2\}\}=\\alpha/\(1\-\\alpha\)whenΔ\>Cα​r\\Delta\>C\_\{\\alpha\}rwithCα=\(1−α\)/1−2​αC\_\{\\alpha\}=\(1\-\\alpha\)/\\sqrt\{1\-2\\alpha\}\. Summing this lower bound over the\(1−α\)​k\(1\{\-\}\\alpha\)kcluster indices forces the directional derivativeD​F​\(x∗;z−x∗\)DF\(x\_\{\*\};z\-x\_\{\*\}\)to be strictly negative, contradicting the first\-order optimality of the geometric median—henceΔ≤Cα​r\\Delta\\leq C\_\{\\alpha\}r\.𝐲0\{\\mathbf\{y\}\}\_\{0\}𝐲1\{\\mathbf\{y\}\}\_\{1\}Δ⋆\\Delta\_\{\\star\}𝒩​\(𝐲0,σ2​𝐈d\)\{\\mathcal\{N\}\}\(\{\\mathbf\{y\}\}\_\{0\},\\sigma^\{2\}\{\\mathbf\{I\}\}\_\{d\}\)𝒩​\(𝐲1,σ2​𝐈d\)\{\\mathcal\{N\}\}\(\{\\mathbf\{y\}\}\_\{1\},\\sigma^\{2\}\{\\mathbf\{I\}\}\_\{d\}\)TV=2​Φ​\(Δ⋆/2​σ\)−1≤α/\(1−α\)=2\\Phi\(\\Delta\_\{\\star\}/2\\sigma\)\-1\\;\\leq\\;\\alpha/\(1\{\-\}\\alpha\)FF𝐲0\{\\mathbf\{y\}\}\_\{0\}𝐲1\{\\mathbf\{y\}\}\_\{1\}ℱα​\(𝐲0\)\{\\mathcal\{F\}\}\_\{\\alpha\}\(\{\\mathbf\{y\}\}\_\{0\}\)ℱα​\(𝐲1\)\{\\mathcal\{F\}\}\_\{\\alpha\}\(\{\\mathbf\{y\}\}\_\{1\}\)F∈ℱα​\(𝐲0\)∩ℱα​\(𝐲1\)F\\in\{\\mathcal\{F\}\}\_\{\\alpha\}\(\{\\mathbf\{y\}\}\_\{0\}\)\\cap\{\\mathcal\{F\}\}\_\{\\alpha\}\(\{\\mathbf\{y\}\}\_\{1\}\)Figure 6:Modulus of continuity for Theorem[2](https://arxiv.org/html/2606.30931#Thmtheorem2)\.Top:total variation between two equal\-covariance Gaussians at separationΔ⋆\\Delta\_\{\\star\}is2​Φ​\(Δ⋆/2​σ\)−12\\Phi\(\\Delta\_\{\\star\}/2\\sigma\)\-1\(*dimension\-free*; depends only on the line through the two centers\)\. The overlap is shaded; when the overlap mass exceedsα/\(1−α\)\\alpha/\(1\{\-\}\\alpha\), the two Huber neighborhoods touch\.Bottom:the contamination classℱα​\(𝐲\)=\{\(1−α\)​𝒩​\(𝐲,σ2​𝐈d\)\+α​Q\}\{\\mathcal\{F\}\}\_\{\\alpha\}\(\{\\mathbf\{y\}\}\)=\\\{\(1\-\\alpha\)\{\\mathcal\{N\}\}\(\{\\mathbf\{y\}\},\\sigma^\{2\}\{\\mathbf\{I\}\}\_\{d\}\)\+\\alpha Q\\\}is depicted as a cloud of distributions around each center; under the threshold above, a single distributionF∈ℱα​\(𝐲0\)∩ℱα​\(𝐲1\)F\\in\{\\mathcal\{F\}\}\_\{\\alpha\}\(\{\\mathbf\{y\}\}\_\{0\}\)\\cap\{\\mathcal\{F\}\}\_\{\\alpha\}\(\{\\mathbf\{y\}\}\_\{1\}\)is consistent with*both*truths\. No estimator can distinguish𝐲0\{\\mathbf\{y\}\}\_\{0\}from𝐲1\{\\mathbf\{y\}\}\_\{1\}on observations drawn fromFF, hence Le Cam’s two\-point bound forces minimax error≥Δ⋆/4≥2​π4​σ​α/\(1−α\)\\geq\\Delta\_\{\\star\}/4\\geq\\tfrac\{\\sqrt\{2\\pi\}\}\{4\}\\,\\sigma\\alpha/\(1\{\-\}\\alpha\),*independent ofNN*\.Table 1:Roadmap of formal results\.Each row links to the result’s full statement \(clickable reference\); proofs are deferred to the[Appendix˜A](https://arxiv.org/html/2606.30931#A1)

## 5Theoretical Guarantees

### 5\.1Finite\-Sample Error Bound

![Refer to caption](https://arxiv.org/html/2606.30931v1/x7.png)\(b\)[Theorem˜1](https://arxiv.org/html/2606.30931#Thmtheorem1)\.
![Refer to caption](https://arxiv.org/html/2606.30931v1/x8.png)\(c\)[Lemma˜2](https://arxiv.org/html/2606.30931#Thmlemma2)\.

Figure 7:Theory validation\.\(a\)Empirical MSE of the arithmetic mean forN=10N\{=\}10equicorrelated clean Gaussian judges matches the closed\-form prediction1\+\(N−1\)​γN​d​σ2\\tfrac\{1\+\(N\{\-\}1\)\\gamma\}\{N\}\\,d\\sigma^\{2\}\(Corollary[1](https://arxiv.org/html/2606.30931#Thmcorollary1)\) across the full rangeγ∈\[0,0\.95\]\\gamma\\in\[0,0\.95\]; the effective jury sizeNeff=N/\(1\+\(N−1\)​γ\)N\_\{\\mathrm\{eff\}\}=N/\(1\+\(N\{\-\}1\)\\gamma\)saturates at1/γ1/\\gamma, motivating the three\-judge committees of §[6](https://arxiv.org/html/2606.30931#S6)\.\(b\)Under worst\-case Huber contamination \(α=0\.3\\alpha\{=\}0\.3,σ=0\.3\\sigma\{=\}0\.3,d=5d\{=\}5, Dirac corruption at𝐲⋆\+10​1\{\\mathbf\{y\}\}^\{\\star\}\+10\\,\{\\mathbf\{1\}\}\), the geometric median converges to the predicted breakdown floorσ​α​d/\(1−α\)≈0\.287\\sigma\\alpha\\sqrt\{d\}/\(1\{\-\}\\alpha\)\\approx 0\.287\(gray dashed\) asNNgrows, matching Theorem[1](https://arxiv.org/html/2606.30931#Thmtheorem1); the arithmetic mean and under\-trimmed mean \(β=α/2\\beta\{=\}\\alpha/2\) plateau above the floor, confirming Proposition[2](https://arxiv.org/html/2606.30931#Thmproposition2)\.\(c\)HoldingN=1000N\{=\}1000fixed and sweeping the dimension, the geometric median tracks the predictedd\\sqrt\{d\}scaling of the cluster radius \(Lemma[2](https://arxiv.org/html/2606.30931#Thmlemma2)\) to within an absolute constant\.We bound‖𝐲^GM−𝐲⋆‖2\\\|\\hat\{\{\\mathbf\{y\}\}\}\_\{\\mathrm\{GM\}\}\-\{\\mathbf\{y\}\}^\{\\star\}\\\|\_\{2\}under our Huber model in two steps: a deterministic geometric lemma about the geometric median \(Lemma[1](https://arxiv.org/html/2606.30931#Thmlemma1), due toMinsker \([2015](https://arxiv.org/html/2606.30931#bib.bib30)\)\), and a probabilistic lemma that controls the sub\-Gaussian cluster radius \(Lemma[2](https://arxiv.org/html/2606.30931#Thmlemma2)\)\. Plugging the cluster radius into the geometric lemma yields Theorem[1](https://arxiv.org/html/2606.30931#Thmtheorem1), our finite\-sample upper bound onRoPoLL\. Full proofs are in Appendix[A](https://arxiv.org/html/2606.30931#A1)\.

###### Lemma 1\(Geometric Breakdown of GM\)\.

*\(Minsker \([2015](https://arxiv.org/html/2606.30931#bib.bib30)\), Lemma 2\.1; building onLopuhaä and Rousseeuw \([1991](https://arxiv.org/html/2606.30931#bib.bib26)\)\.\)*Letx1,…,xk∈ℝdx\_\{1\},\\ldots,x\_\{k\}\\in\\mathbb\{R\}^\{d\}and letx∗x\_\{\*\}be any minimizer ofz↦∑j=1k‖z−xj‖2z\\mapsto\\sum\_\{j=1\}^\{k\}\\\|z\-x\_\{j\}\\\|\_\{2\}\(a geometric median\)\. Fixα∈\(0,1/2\)\\alpha\\in\(0,1/2\),r\>0r\>0, andz∈ℝdz\\in\\mathbb\{R\}^\{d\}\. If\|\{j:‖xj−z‖2≤r\}\|≥\(1−α\)​k\|\\\{j:\\\|x\_\{j\}\-z\\\|\_\{2\}\\leq r\\\}\|\\geq\(1\-\\alpha\)k, then

‖x∗−z‖2≤Cα​r,Cα≜1−α1−2​α\.\\big\\\|x\_\{\*\}\-z\\big\\\|\_\{2\}\\;\\leq\\;C\_\{\\alpha\}\\,r,\\qquad C\_\{\\alpha\}\\;\\triangleq\\;\\frac\{1\-\\alpha\}\{\\sqrt\{1\-2\\alpha\}\}\.\(16\)

This is purely deterministic: a multiplicative bound between the geometric median and any targetzzin terms of how concentrated the inputs are aroundzz\. The constantCαC\_\{\\alpha\}is sharp and diverges asα→1/2\\alpha\\to 1/2, matching the breakdown point of GM\.[Figure˜5](https://arxiv.org/html/2606.30931#S4.F5)illustrates the geometric core of the proof: under the contradiction hypothesisΔ=‖x∗−z‖2\>Cα​r\\Delta=\\\|x\_\{\*\}\-z\\\|\_\{2\}\>C\_\{\\alpha\}r, the cluster ball subtends a narrow cone atx∗x\_\{\*\}, forcing the\(1−α\)​k\(1\{\-\}\\alpha\)kcluster points to lie inside it—and a balance of unit\-vector subgradients \(the first\-order optimality condition for the geometric median\) produces the contradiction\.

###### Lemma 2\(Sub\-Gaussian Cluster Radius\)\.

Under Assumptions[2](https://arxiv.org/html/2606.30931#Thmassumption2)–[5](https://arxiv.org/html/2606.30931#Thmassumption5), letβ∈\(0,1/2−α\)\\beta\\in\(0,\\,1/2\-\\alpha\)be a slack parameter\. With probability at least1−exp⁡\(−N​β2/2\)1\-\\exp\(\-N\\beta^\{2\}/2\),

\|\{i∈\[N\]:‖𝐲^i−𝐲⋆‖2≤ρ\}\|≥\(1−α−β\)​N,\\big\|\\big\\\{i\\in\[N\]:\\\|\\hat\{\{\\mathbf\{y\}\}\}\_\{i\}\-\{\\mathbf\{y\}\}^\{\\star\}\\\|\_\{2\}\\leq\\rho\\big\\\}\\big\|\\;\\geq\\;\(1\-\\alpha\-\\beta\)\\,N,\(17\)where the cluster radius is

ρ=σ​\(C1​d\+1c​log⁡2​\(1−α\)β\),\\rho\\;=\\;\\sigma\\\!\\left\(C\_\{1\}\\sqrt\{d\}\\;\+\\;\\sqrt\{\\frac\{1\}\{c\}\\,\\log\\\!\\frac\{2\(1\-\\alpha\)\}\{\\beta\}\}\\right\),\(18\)andC1,c\>0C\_\{1\},c\>0are absolute constants \(from the sub\-Gaussian\-norm tail bound, Step 1 of the proof in Appendix[A\.6](https://arxiv.org/html/2606.30931#A1.SS6)\)\.

The slackβ\\betacontrols a trade\-off: a largerβ\\betapermits a smaller cluster radiusρ\\rho\(since fewer competent samples need to be inside\) but augments the effective contamination threshold fromα\\alphatoα\+β\\alpha\+\\betain the geometric step\.

###### Theorem 1\(RoPoLLBreakdown Bound under Huber Contamination\)\.

Under Assumptions[2](https://arxiv.org/html/2606.30931#Thmassumption2)–[5](https://arxiv.org/html/2606.30931#Thmassumption5), fix any slackβ∈\(0,1/2−α\)\\beta\\in\(0,\\,1/2\-\\alpha\)\. With probability at least1−exp⁡\(−N​β2/2\)1\-\\exp\(\-N\\beta^\{2\}/2\),

‖𝐲^GM−𝐲⋆‖2≤1−α−β1−2​α−2​β⏟Cα\+β⋅σ​\(C1​d\+1c​log⁡2​\(1−α\)β\)⏟ρ\.\\big\\\|\\hat\{\{\\mathbf\{y\}\}\}\_\{\\mathrm\{GM\}\}\-\{\\mathbf\{y\}\}^\{\\star\}\\big\\\|\_\{2\}\\;\\leq\\;\\underbrace\{\\frac\{1\-\\alpha\-\\beta\}\{\\sqrt\{1\-2\\alpha\-2\\beta\}\}\}\_\{C\_\{\\alpha\+\\beta\}\}\\;\\cdot\\;\\underbrace\{\\sigma\\\!\\left\(C\_\{1\}\\sqrt\{d\}\\;\+\\;\\sqrt\{\\frac\{1\}\{c\}\\log\\\!\\frac\{2\(1\-\\alpha\)\}\{\\beta\}\}\\right\)\}\_\{\\rho\}\.\(19\)

The proof is a one\-line combination: applying Lemma[1](https://arxiv.org/html/2606.30931#Thmlemma1)withk=Nk=N,z=𝐲⋆z=\{\\mathbf\{y\}\}^\{\\star\},r=ρr=\\rho, and effective thresholdα′=α\+β<1/2\\alpha^\{\\prime\}=\\alpha\+\\beta<1/2, the count bound from Lemma[2](https://arxiv.org/html/2606.30931#Thmlemma2)is exactly the hypothesis of Lemma[1](https://arxiv.org/html/2606.30931#Thmlemma1), so the geometric lemma gives‖𝐲^GM−𝐲⋆‖2≤Cα\+β​ρ\\\|\\hat\{\{\\mathbf\{y\}\}\}\_\{\\mathrm\{GM\}\}\-\{\\mathbf\{y\}\}^\{\\star\}\\\|\_\{2\}\\leq C\_\{\\alpha\+\\beta\}\\,\\rho\. Full details are in Appendix[A\.7](https://arxiv.org/html/2606.30931#A1.SS7)\.

#### Interpretation\.

The bound has two components\. The geometric constantCα\+βC\_\{\\alpha\+\\beta\}depends only on the contamination rate \(and slack\); it diverges asα\+β→1/2\\alpha\+\\beta\\to 1/2, encoding the breakdown point\. The cluster radiusρ\\rhodepends only on the noise scaleσ\\sigmaand the dimensiondd; it does*not*shrink withNN\. This reflects the breakdown\-point character of plain GM: under arbitraryQQin the Huber class, the asymptotic\-NNfloor is set by the cluster radius, not by sample averaging\. The bound is distribution\-free over the corruption class\{Qi\}\\\{Q\_\{i\}\\\}\.[Figure˜4](https://arxiv.org/html/2606.30931#S4.F4)illustrates the two\-step geometry\. For comparison with the matching minimax lower bound \(Theorem[2](https://arxiv.org/html/2606.30931#Thmtheorem2)\), see §[5\.2](https://arxiv.org/html/2606.30931#S5.SS2)\.

#### Synthetic validation\.

[Figure˜7](https://arxiv.org/html/2606.30931#S5.F7)validates the i\.i\.d\. theory on controlled synthetic data: panel \(a\) confirms the closed\-form clean\-jury MSE of Corollary[1](https://arxiv.org/html/2606.30931#Thmcorollary1); panel \(b\) shows the geometric median converging to the predicted breakdown floorσ​α​d/\(1−α\)\\sigma\\alpha\\sqrt\{d\}/\(1\-\\alpha\)asNNgrows under worst\-case Huber contamination, whilePoLLstays above the floor \(Proposition[2](https://arxiv.org/html/2606.30931#Thmproposition2)\); panel \(c\) confirms thed\\sqrt\{d\}scaling of the cluster radiusρ\\rho\(Lemma[2](https://arxiv.org/html/2606.30931#Thmlemma2)\) at fixedNN\.

#### Beyond i\.i\.d\.: equicorrelated juries\.

Theorem[1](https://arxiv.org/html/2606.30931#Thmtheorem1)assumes conditional independence \(Assumption[3](https://arxiv.org/html/2606.30931#Thmassumption3)\)\. Real LLM juries trained on overlapping corpora violate this: inter\-judge correlationγ¯∈\[0\.3,0\.7\]\\bar\{\\gamma\}\\in\[0\.3,0\.7\]is typical \([Figures˜14](https://arxiv.org/html/2606.30931#S6.F14)and[6\.9](https://arxiv.org/html/2606.30931#S6.SS9)\)\. We close §[5\.1](https://arxiv.org/html/2606.30931#S5.SS1)by extending Theorem[1](https://arxiv.org/html/2606.30931#Thmtheorem1)to this regime: the breakdown structure \(Cα\+βC\_\{\\alpha\+\\beta\}andρ\\rho\) survives unchanged; only the high\-probability event weakens, from exponential inNNto polynomial in the*effective jury size*Neff=N/\(1\+\(N−1\)​γ¯W\)N\_\{\\mathrm\{eff\}\}=N/\(1\+\(N\-1\)\\bar\{\\gamma\}\_\{W\}\)familiar from Corollary[1](https://arxiv.org/html/2606.30931#Thmcorollary1)\.

###### Lemma 3\(RoPoLLunder Equicorrelated Juries\)\.

Replace Assumption[3](https://arxiv.org/html/2606.30931#Thmassumption3)with the weaker*equicorrelated\-indicator*assumption: for the cluster indicatorsWi≜𝟙​\{Zi=0,‖𝐲^i−𝐲⋆‖2≤ρp\}W\_\{i\}\\triangleq\\mathbb\{1\}\\\{Z\_\{i\}=0,\\ \\\|\\hat\{\{\\mathbf\{y\}\}\}\_\{i\}\-\{\\mathbf\{y\}\}^\{\\star\}\\\|\_\{2\}\\leq\\rho\_\{p\}\\\}of Lemma[2](https://arxiv.org/html/2606.30931#Thmlemma2),Cov​\(Wi,Wj\)≤γ¯W​Var​\(Wi\)​Var​\(Wj\)\\mathrm\{Cov\}\(W\_\{i\},W\_\{j\}\)\\leq\\bar\{\\gamma\}\_\{W\}\\sqrt\{\\mathrm\{Var\}\(W\_\{i\}\)\\mathrm\{Var\}\(W\_\{j\}\)\}for alli≠ji\\neq j, withγ¯W∈\[0,1\]\\bar\{\\gamma\}\_\{W\}\\in\[0,1\]\. Under Assumptions[2](https://arxiv.org/html/2606.30931#Thmassumption2),[4](https://arxiv.org/html/2606.30931#Thmassumption4),[5](https://arxiv.org/html/2606.30931#Thmassumption5)and the equicorrelated\-indicator assumption, fix any slackβ∈\(0,1/2−α\)\\beta\\in\(0,1/2\-\\alpha\)\. With probability at least

1−1β2​Neff,Neff≜N1\+\(N−1\)​γ¯W,1\-\\frac\{1\}\{\\beta^\{2\}\\,N\_\{\\mathrm\{eff\}\}\},\\qquad N\_\{\\mathrm\{eff\}\}\\;\\triangleq\\;\\frac\{N\}\{1\+\(N\-1\)\\bar\{\\gamma\}\_\{W\}\},\(20\)the bound‖𝐲^GM−𝐲⋆‖2≤Cα\+β​ρ\\\|\\hat\{\{\\mathbf\{y\}\}\}\_\{\\mathrm\{GM\}\}\-\{\\mathbf\{y\}\}^\{\\star\}\\\|\_\{2\}\\leq C\_\{\\alpha\+\\beta\}\\,\\rhoof Theorem[1](https://arxiv.org/html/2606.30931#Thmtheorem1)holds, withCα\+βC\_\{\\alpha\+\\beta\}andρ\\rhounchanged\. Atγ¯W=0\\bar\{\\gamma\}\_\{W\}=0, the equicorrelated assumption reduces to independence and Theorem[1](https://arxiv.org/html/2606.30931#Thmtheorem1)’s exponential boundexp⁡\(−N​β2/2\)\\exp\(\-N\\beta^\{2\}/2\)recovers \(which is strictly tighter than \([20](https://arxiv.org/html/2606.30931#S5.E20)\)\)\.

The proof replaces the Hoeffding step of Lemma[2](https://arxiv.org/html/2606.30931#Thmlemma2)with a Chebyshev bound on∑iWi\\sum\_\{i\}W\_\{i\}under the bounded\-covariance hypothesis; the cluster radiusρ\\rhoand the geometric constantCα\+βC\_\{\\alpha\+\\beta\}are unchanged because Lemma[1](https://arxiv.org/html/2606.30931#Thmlemma1)is purely deterministic\. The hypothesis is on the indicator correlationγ¯W\\bar\{\\gamma\}\_\{W\}, which we estimate directly from the empirical co\-incidence of cluster events\{Wi=1\}\\\{W\_\{i\}=1\\\}on our1313\-judge experimental panels \([Sections˜6\.10](https://arxiv.org/html/2606.30931#S6.SS10)and[3](https://arxiv.org/html/2606.30931#S6.T3)\): across three cluster\-radius calibrations \(50th/70th/90th percentiles of pooled per\-sample deviations\),γ¯W∈\[0\.45,0\.53\]\\bar\{\\gamma\}\_\{W\}\\in\[0\.45,0\.53\]on HelpSteer\-2 and UltraFeedback, in line with the inter\-judge*score*correlationsγ¯∈\[0\.49,0\.71\]\\bar\{\\gamma\}\\in\[0\.49,0\.71\]of[Figure˜14](https://arxiv.org/html/2606.30931#S6.F14)\. AtN=3N\{=\}3this givesNeff∈\[1\.45,1\.58\]N\_\{\\mathrm\{eff\}\}\\in\[1\.45,1\.58\]; the breakdown floor and geometric constant are unaffected, and the high\-probability event remains non\-trivial for the moderate slackβ\\betaused in practice\. Full details are in Appendix[A\.8](https://arxiv.org/html/2606.30931#A1.SS8)\.

### 5\.2Minimax Lower Bound

We close the section with a matching information\-theoretic minimax lower bound that exposes ad\\sqrt\{d\}statistical–computational gap:RoPoLLis rate\-optimal up to a dimensional constant on the breakdown floor, the price forO​\(N​d​log⁡\(1/ϵ\)\)O\(Nd\\log\(1/\{\\epsilon\}\)\)tractability via the Weiszfeld iteration\. No estimator can do better on the parametric variance term; the breakdown floor, in turn, is matched up to a dimensional constant only by the \(intractable\) Tukey halfspace median\.

###### Theorem 2\(Minimax Lower Bound\)\.

Under the same assumptions as Theorem[1](https://arxiv.org/html/2606.30931#Thmtheorem1),

inf𝐲^supF∈ℱα,σ𝔼F​\[‖𝐲^−𝐲⋆‖2\]≥c​σ​\(d/N\+α1−α\),\\inf\_\{\\hat\{\{\\mathbf\{y\}\}\}\}\\;\\sup\_\{F\\in\{\\mathcal\{F\}\}\_\{\\alpha,\\sigma\}\}\\;\\mathbb\{E\}\_\{F\}\\\!\\left\[\\\|\\hat\{\{\\mathbf\{y\}\}\}\-\{\\mathbf\{y\}\}^\{\\star\}\\\|\_\{2\}\\right\]\\;\\geq\\;c\\sigma\\\!\\left\(\\sqrt\{d/N\}\\;\+\\;\\frac\{\\alpha\}\{1\-\\alpha\}\\right\),\(21\)where the infimum is over all measurable estimators of the form𝐲^​\(𝐲^1,…,𝐲^N\)\\hat\{\{\\mathbf\{y\}\}\}\(\\hat\{\{\\mathbf\{y\}\}\}\_\{1\},\\ldots,\\hat\{\{\\mathbf\{y\}\}\}\_\{N\}\),ℱα,σ\{\\mathcal\{F\}\}\_\{\\alpha,\\sigma\}is the class of joint distributions consistent with Assumptions[2](https://arxiv.org/html/2606.30931#Thmassumption2),[3](https://arxiv.org/html/2606.30931#Thmassumption3),[4](https://arxiv.org/html/2606.30931#Thmassumption4), and[5](https://arxiv.org/html/2606.30931#Thmassumption5), andc\>0c\>0is a universal constant\.

###### Proof sketch\.

We use Le Cam’s two\-point method\. For thed/N\\sqrt\{d/N\}term, setα=0\\alpha=0and pit two clean Gaussian hypotheses𝐲0=𝟎\{\\mathbf\{y\}\}\_\{0\}=\{\\mathbf\{0\}\}vs\.𝐲1=Δ​𝐞1\{\\mathbf\{y\}\}\_\{1\}=\\Delta\\,\{\\mathbf\{e\}\}\_\{1\}withΔ=c1​σ​d/N\\Delta=c\_\{1\}\\sigma\\sqrt\{d/N\}; the standard Pinsker\-plus\-tensorisation calculation givesTV​\(F0⊗N,F1⊗N\)≤1/2\\mathrm\{TV\}\(F\_\{0\}^\{\\otimes N\},F\_\{1\}^\{\\otimes N\}\)\\leq 1/2\. For theα/\(1−α\)\\alpha/\(1\-\\alpha\)term, we exploit the*modulus of continuity*of the Huber neighborhood: the contamination classℱα​\(𝐲\)=\{\(1−α\)​𝒩​\(𝐲,σ2​𝐈d\)\+α​Q\}\{\\mathcal\{F\}\}\_\{\\alpha\}\(\{\\mathbf\{y\}\}\)=\\\{\(1\-\\alpha\)\{\\mathcal\{N\}\}\(\{\\mathbf\{y\}\},\\sigma^\{2\}\{\\mathbf\{I\}\}\_\{d\}\)\+\\alpha Q\\\}contains a common distribution at two centers𝐲0,𝐲1\{\\mathbf\{y\}\}\_\{0\},\{\\mathbf\{y\}\}\_\{1\}whenever‖𝒩​\(𝐲0,σ2​𝐈d\)−𝒩​\(𝐲1,σ2​𝐈d\)‖TV≤α/\(1−α\)\\\|\{\\mathcal\{N\}\}\(\{\\mathbf\{y\}\}\_\{0\},\\sigma^\{2\}\{\\mathbf\{I\}\}\_\{d\}\)\-\{\\mathcal\{N\}\}\(\{\\mathbf\{y\}\}\_\{1\},\\sigma^\{2\}\{\\mathbf\{I\}\}\_\{d\}\)\\\|\_\{\\mathrm\{TV\}\}\\leq\\alpha/\(1\-\\alpha\), since both\(1−α\)​𝒩​\(𝐲0,σ2​𝐈d\)\(1\-\\alpha\)\{\\mathcal\{N\}\}\(\{\\mathbf\{y\}\}\_\{0\},\\sigma^\{2\}\{\\mathbf\{I\}\}\_\{d\}\)and\(1−α\)​𝒩​\(𝐲1,σ2​𝐈d\)\(1\-\\alpha\)\{\\mathcal\{N\}\}\(\{\\mathbf\{y\}\}\_\{1\},\\sigma^\{2\}\{\\mathbf\{I\}\}\_\{d\}\)are then dominated componentwise by a single probability measure\. TV between two equal\-covariance Gaussians at separationΔ\\Deltais2​Φ​\(Δ/\(2​σ\)\)−12\\Phi\(\\Delta/\(2\\sigma\)\)\-1\(*dimension\-free*\), so the largest indistinguishable separation isΔ⋆=2​σ​Φ−1​\(12\+α2​\(1−α\)\)≥2​π​σ​α/\(1−α\)\\Delta\_\{\\star\}=2\\sigma\\Phi^\{\-1\}\\\!\\left\(\\tfrac\{1\}\{2\}\+\\tfrac\{\\alpha\}\{2\(1\-\\alpha\)\}\\right\)\\geq\\sqrt\{2\\pi\}\\,\\sigma\\alpha/\(1\-\\alpha\)\. Le Cam then gives error at leastΔ⋆/4\\Delta\_\{\\star\}/4\. The full proof is in Appendix[A\.9](https://arxiv.org/html/2606.30931#A1.SS9)\. ∎

[Figure˜6](https://arxiv.org/html/2606.30931#S4.F6)illustrates the modulus\-of\-continuity construction: when the two Gaussians at𝐲0\{\\mathbf\{y\}\}\_\{0\}and𝐲1\{\\mathbf\{y\}\}\_\{1\}are TV\-close enough, their Huber neighborhoods overlap at a common distributionFFthat is consistent with both truths—making the two centers indistinguishable from any number of i\.i\.d\. samples\.

#### Comparison with the upper bound\.

Theorems[1](https://arxiv.org/html/2606.30931#Thmtheorem1)and[2](https://arxiv.org/html/2606.30931#Thmtheorem2)match exactly on the parametric rateσ​d/N\\sigma\\sqrt\{d/N\}\. On the breakdown floor they differ by ad\\sqrt\{d\}factor: the upper bound scales asCα​σ​dC\_\{\\alpha\}\\sigma\\sqrt\{d\}while the lower bound scales asσ​α/\(1−α\)\\sigma\\alpha/\(1\-\\alpha\)\. This is not a slack in the analysis but a real statistical–computational gap\. The minimax\-optimal estimator on the breakdown floor is the*Tukey halfspace median*\(Tukey,[1975](https://arxiv.org/html/2606.30931#bib.bib36); Donoho and Gasko,[1992](https://arxiv.org/html/2606.30931#bib.bib37)\), whose exact computation is NP\-hard ford≥3d\\geq 3\(Johnson and Preparata,[1978](https://arxiv.org/html/2606.30931#bib.bib38); Aloupis,[2006](https://arxiv.org/html/2606.30931#bib.bib39)\); the smoothed\-depth estimator ofChenet al\.\([2018](https://arxiv.org/html/2606.30931#bib.bib40)\)matches theσ​α\\sigma\\alphafloor in sub\-exponential time\. The geometric median is the polynomial\-time alternative: it shares the optimal1/21/2breakdown point but pays ad\\sqrt\{d\}price forO​\(N​d​log⁡\(1/ϵ\)\)O\(Nd\\log\(1/\{\\epsilon\}\)\)tractability via the Weiszfeld iteration \(§[4\.3](https://arxiv.org/html/2606.30931#S4.SS3)\)\. For LLM juries the trade is favourable:ddis small \(1–5 in our benchmarks\) so thed\\sqrt\{d\}overhead is at most∼2\.2×\\sim 2\.2\\times, and atN=3N=3the variance termσ​d/N\\sigma\\sqrt\{d/N\}dominates the breakdown floor on every regime we test \(§[6\.6](https://arxiv.org/html/2606.30931#S6.SS6)\)\.RoPoLLis therefore an*efficient*robust estimator, matching the minimax breakdown point at the small price of a dimensional constant on the contamination floor\.

#### Scope of the i\.i\.d\. assumptions\.

Theorems[1](https://arxiv.org/html/2606.30931#Thmtheorem1)and[2](https://arxiv.org/html/2606.30931#Thmtheorem2)are stated under the i\.i\.d\. baseline \(Asm[3](https://arxiv.org/html/2606.30931#Thmassumption3), identicalσi\\sigma\_\{i\}\)\. Lemma[3](https://arxiv.org/html/2606.30931#Thmlemma3)relaxes independence to equicorrelation, covering the inter\-judge correlationγ¯∈\[0\.3,0\.7\]\\bar\{\\gamma\}\\in\[0\.3,0\.7\]measured in our experiments\. Two further deviations remain out of scope: per\-judge*heterogeneity*\(σi,αi\\sigma\_\{i\},\\alpha\_\{i\}varying across the44–675675B parameter range\) and*explicit dependence*by design \(peer\-rank discussion\(Liet al\.,[2024](https://arxiv.org/html/2606.30931#bib.bib11)\), multi\-agent debate\(Chanet al\.,[2024](https://arxiv.org/html/2606.30931#bib.bib12)\), judge networks\(Zhanget al\.,[2024](https://arxiv.org/html/2606.30931#bib.bib14)\)\)\. The empirical evaluation in §[6](https://arxiv.org/html/2606.30931#S6)holds these axes fixed and isolates the effect of contamination type and rate; the heterogeneous\-jury extension—together with side information such as per\-judge calibration on a labeled validation slice—is the subject of follow\-up work\.

## 6Experiments

We evaluateRoPoLLagainstPoLL\(the arithmetic\-mean baseline ofVergaet al\.\([2024](https://arxiv.org/html/2606.30931#bib.bib5)\)\) and the coordinate\-wiseMedianon three reward\-model benchmarks under a per\-case corruption pipeline that exposes the corruption\-type dependence predicted by Theorem[1](https://arxiv.org/html/2606.30931#Thmtheorem1)and Example[1](https://arxiv.org/html/2606.30931#Thmexample1)\.

![Refer to caption](https://arxiv.org/html/2606.30931v1/x9.png)

![Refer to caption](https://arxiv.org/html/2606.30931v1/x10.png)\(a\)HelpSteer 2
![Refer to caption](https://arxiv.org/html/2606.30931v1/x11.png)\(b\)HelpSteer 3
![Refer to caption](https://arxiv.org/html/2606.30931v1/x12.png)\(c\)UltraFeedback

Figure 8:Parameter efficiency ofRoPoLLjuries vs\. individual judges underbimodal\-randomcorruption atr=30%r=30\\%\.RMSE vs\. parameter count \(log scale\) for each dataset; gray circles are the 13 individual open\-weight judges \(four anchors labelled\), dashed line is their log\-linear scaling fit, and coloured stars mark the fourRoPoLLjuries \(Medium/Mixed/Small/Tiny\) at their aggregate parameter budget—all evaluated under identical30%30\\%per\-case corruption\.bimodal\-randomdrives each coordinate of a corrupted score independently to an extremum, instantiating the cross\-dimensional failure mode of Example[1](https://arxiv.org/html/2606.30931#Thmexample1); clean\-baseline andzeroscounterparts are in[Figures˜10](https://arxiv.org/html/2606.30931#S6.F10)and[9](https://arxiv.org/html/2606.30931#S6.F9)\.### 6\.1Setup

#### Datasets\.

We use three popular reward model benchmarks with complementary ground\-truth sources\.HelpSteer 2\(Wanget al\.,[2024](https://arxiv.org/html/2606.30931#bib.bib25)\)contributes1,0001\{,\}000samples drawn uniformly at random from the validation split, each rated on a0–44Likert scale across five attributes \(helpfulness, correctness, coherence, complexity, verbosity\) by trained human annotators\.HelpSteer 3\(Wanget al\.,[2025](https://arxiv.org/html/2606.30931#bib.bib48)\)contributes its full2,0172\{,\}017\-sample multilingual validation split; the native chosen\-vs\-rejected preference is converted to a scalaroverall\_preferencetarget on\[−4,4\]\[\-4,4\]by re\-scoring both responses on the HelpSteer 2 rubric and taking the signed difference\.UltraFeedback\(Cuiet al\.,[2024](https://arxiv.org/html/2606.30931#bib.bib49)\)contributes1,0001\{,\}000samples scored on a11–55scale across four attributes \(helpfulness, honesty, instruction following, truthfulness\) using GPT\-4 as the reference annotator\.

#### Judges and juries\.

We score every sample with1313open\-weight judges spanning44–675675B parameters at temperature0under a shared structured rubric: Mistral\-Large\-3 \(675675B\), DeepSeek\-V3\.1 \(671671B\), Qwen3\-235B, Qwen3\-32B, Nemotron\-30B, Gemma\-27B, Magistral\-Small \(2424B\), Ministral\-14B, Gemma\-12B, Nemotron\-12B, Nemotron\-9B, Ministral\-8B, and Gemma\-4B\. From these we curate four three\-judge committees that trade size against compute:Medium≈89\\approx 89B \(Qwen3\-32B, Nemotron\-30B, Gemma\-27B\),Mixed≈53\\approx 53B \(Qwen3\-32B, Gemma\-12B, Nemotron\-9B\),Small≈38\\approx 38B \(Ministral\-14B, Gemma\-12B, Nemotron\-12B\), andTiny≈21\\approx 21B \(Nemotron\-9B, Ministral\-8B, Gemma\-4B\)\. The choice ofN=3N=3is not arbitrary: under the equicorrelated jury model of Corollary[1](https://arxiv.org/html/2606.30931#Thmcorollary1)the effective jury sizeNeff=N/\(1\+\(N−1\)​γ\)N\_\{\\mathrm\{eff\}\}=N/\(1\+\(N\-1\)\\gamma\)saturates at1/γ1/\\gammaasN→∞N\\to\\infty, so for the moderate inter\-judge correlationγ∈\[0\.3,0\.5\]\\gamma\\in\[0\.3,0\.5\]characteristic of diverse but non\-orthogonal LLM backbones,NeffN\_\{\\mathrm\{eff\}\}saturates already atN≈2N\\approx 2–33\([Figure˜7\(a\)](https://arxiv.org/html/2606.30931#S5.F7.sf1)of[Figure˜7](https://arxiv.org/html/2606.30931#S5.F7), §[5\.1](https://arxiv.org/html/2606.30931#S5.SS1)\)—a prediction corroborated by the empirical diminishing\-returns knee atN=3N=3in[Figure˜11](https://arxiv.org/html/2606.30931#S6.F11)\. We comparePoLL\(arithmetic mean\), the coordinate\-wiseMedian, andRoPoLL\(Algorithm[1](https://arxiv.org/html/2606.30931#alg1)\) on these committees; all three operate on the same three \(possibly corrupted\) score vectors per sample\.

#### Per\-case corruption protocol\.

Rather than injecting extra adversarial judges into a fixed pool, we hold the jury size at three and corrupt individual \(sample, judge\)*cells*at a per\-case rater∈\{0%,10%,20%,30%,40%,50%\}r\\in\\\{0\\%,10\\%,20\\%,30\\%,40\\%,50\\%\\\}, matching the realistic failure pattern in which a judge occasionally emits a bad score on a specific input\. The sweep range is calibrated against the natural\-failure characterization of[Figure˜2](https://arxiv.org/html/2606.30931#S3.F2)\(§[3\.4](https://arxiv.org/html/2606.30931#S3.SS4)\): naturally\-occurring rates span0\.59%0\.59\\%on HelpSteer 2 to33%33\\%on HelpSteer 3 multilingual, sor∈\[0,50%\]r\\in\[0,50\\%\]covers the natural regime and stress\-tests beyond\. We consider four corruption types covering distinct adversarial regimes:*\(i\)*zeros, where every corrupted slot is replaced by𝟎\{\\mathbf\{0\}\}\(the parser\-failure fallback\);*\(ii\)*inverted, where corrupted slots are replaced byK⋅𝟏−𝐲⋆K\\cdot\{\\mathbf\{1\}\}\-\{\\mathbf\{y\}\}^\{\\star\}\(the worst\-case anti\-correlated Byzantine attack\);*\(iii\)*bimodal\-random, where each coordinate of the corrupted slot is independently set to0orKKwith equal probability \(the cross\-dimensional failure mode of Example[1](https://arxiv.org/html/2606.30931#Thmexample1)\); and*\(iv\)*cauchy\-far, where each corrupted slot is drawn as𝐲⋆\+10\+2​\(smax−smin\)⋅𝐭\{\\mathbf\{y\}\}^\{\\star\}\+10\+2\(s\_\{\\max\}\\\!\-\\\!s\_\{\\min\}\)\\\!\\cdot\\\!\{\\mathbf\{t\}\}with𝐭\{\\mathbf\{t\}\}component\-wise standard Cauchy \(a biased heavy\-tailed Byzantine attack with undefined mean and variance\)\. Pre\-existing parser failures from real judges are dropped atr=0%r=0\\%and replaced with adversarial vectors atr\>0%r\>0\\%, so the effective observed corruption rate atr\>0r\>0isf\+\(1−f\)​rf\+\(1\-f\)\\,rwithffthe naturally occurring parser\-failure rate\. We report RMSE against the reference labels; per\-judge calibration breakdowns \(MAE, mean bias\) on the UltraFeedback rubric dimensions are in Appendix[B\.2](https://arxiv.org/html/2606.30931#A2.SS2)\.

### 6\.2Heavy\-Tailed Corruption

Thecauchy\-farattack is the empirical analogue of the adversarial choice in Proposition[2](https://arxiv.org/html/2606.30931#Thmproposition2): each corrupted slot has an unbounded first moment, and a single contaminated judge can in principle dragPoLLby an arbitrary amount\. The teaser \([Figure˜1](https://arxiv.org/html/2606.30931#S1.F1), queued in §[1](https://arxiv.org/html/2606.30931#S1)\) confirms this empirically\. On theMediumjury,PoLL’s RMSE exceedsRoPoLL’s by one to three orders of magnitude at everyr≥10%r\\geq 10\\%on all three benchmarks\. The largest gap occurs on HelpSteer 2 atr=40%r=40\\%, wherePoLL’s RMSE reaches≈4,951\\approx 4\{,\}951whileRoPoLLholds at≈9\.2\\approx 9\.2—a ratio of≈540×\\approx 540\\times\. The coordinate\-wiseMedianis competitive withRoPoLLhere \(full three\-method comparison in[Figure˜12](https://arxiv.org/html/2606.30931#S6.F12), §[6\.6](https://arxiv.org/html/2606.30931#S6.SS6)\): under heavy\-tailed Byzantine attacks*any*robust aggregator beats the mean, exactly as the theory predicts\.

### 6\.3Cross\-Dimensional Corruption

Thebimodal\-randomattack drives each coordinate of a corrupted score independently to an extremum—each corrupted score is plausible per coordinate but jointly anomalous, the failure mode predicted by Example[1](https://arxiv.org/html/2606.30931#Thmexample1)\.[Figure˜8](https://arxiv.org/html/2606.30931#S6.F8)plots, for each benchmark, the1313individual judges \(gray circles\) against their parameter count alongside the fourRoPoLLcommittees \(coloured stars\) at their aggregate parameter count, both evaluated under identical30%30\\%bimodal\-randomcorruption\. On HelpSteer 2 and UltraFeedback,*all four*RoPoLLcommittees sit visibly below the individual\-at\-30% scaling trend\. The headline number: on HelpSteer 2, theSmallcommittee at3838B reaches RMSE=1\.18=1\.18, beating Mistral\-Large\-3’s1\.551\.55at675675B—a1\.31×1\.31\\timesaccuracy advantage at18×18\\timesfewer parameters\. On the harder HelpSteer 3 \(signed\-preference target\), theMediumcommittee at8989B still matches DeepSeek\-V3\.1 \(671671B\) at RMSE=1\.85=1\.85\.

#### Compute\-matched comparison\.

The single\-judge\-vs\-committee framing above understates the case for robust aggregation, because*any*3\-judge committee \(114114B–267267B forward\-pass compute\) beats a single675675B judge at evaluation cost\. The fair compute\-matched comparison isRoPoLLversusPoLLon the same committee\. On theSmallcommittee at30%30\\%bimodal\-random,RoPoLL\(RMSE1\.181\.18\) beatsPoLL\(RMSE≈1\.45\\approx 1\.45\) on the same three judges by≈19%\\approx 19\\%at*identical*inference cost \([Figure˜12](https://arxiv.org/html/2606.30931#S6.F12), full grid\): the parameter\-efficiency advantage holds because the geometric median’s joint\-distance objective extracts more signal from the same forward passes thanPoLL\.*Robust aggregation, not the ensemble itself, is what delivers the win\.*

### 6\.4Bounded Mean\-Preserving Corruptions: Zeros and Inverted

![Refer to caption](https://arxiv.org/html/2606.30931v1/x13.png)

![Refer to caption](https://arxiv.org/html/2606.30931v1/x14.png)\(a\)HelpSteer 2
![Refer to caption](https://arxiv.org/html/2606.30931v1/x15.png)\(b\)HelpSteer 3
![Refer to caption](https://arxiv.org/html/2606.30931v1/x16.png)\(c\)UltraFeedback

Figure 9:Parameter efficiency ofRoPoLLjuries vs\. individual judges underzeroscorruption atr=30%r=30\\%\.RMSE vs\. parameter count \(log scale\) for each dataset; gray circles are the 13 individual open\-weight judges \(four anchors labelled\), dashed line is their log\-linear scaling fit, and coloured stars mark the fourRoPoLLjuries at their aggregate parameter budget, all under identical30%30\\%per\-case corruption\.zerosreplaces each corrupted slot with the parser\-fallback vector𝟎\{\\mathbf\{0\}\}; the directRoPoLLvs\.PoLLcontrast is deferred to[Figure˜12](https://arxiv.org/html/2606.30931#S6.F12)\.Thezerosandinvertedattacks place corrupted scores at fixed bounded points on the score scale\. On a bounded scalePoLLis*mean\-preserving*under uniform\-rate corruption when the corrupted point happens to lie at the scale midpoint—an empirical accident, not a property of the mean as an estimator—which makes these the regimes whereRoPoLLandPoLLshould be hardest to separate\.[Figure˜9](https://arxiv.org/html/2606.30931#S6.F9)plots the parameter\-efficiency view under30%30\\%zeroscorruption on the same axes as[Figure˜8](https://arxiv.org/html/2606.30931#S6.F8)\. The headline: even in this favourable\-to\-the\-mean regime, all fourRoPoLLcommittees sit at or below the individual\-at\-30% scaling line on every benchmark, and the gap toPoLLremains positive but small \(≤0\.3\\leq 0\.3RMSE for theMediumjury across the full corruption sweep—see[Figure˜12](https://arxiv.org/html/2606.30931#S6.F12)\)\.RoPoLLis therefore not a universal replacement for the mean: when the corruption is bounded and happens to be mean\-preserving, the two are within an insurance premium of each other\. The argument forRoPoLLas a default is that the practitioner does not get to choose which regime the next corruption falls into\.

### 6\.5Clean\-Baseline Parameter Efficiency

![Refer to caption](https://arxiv.org/html/2606.30931v1/x17.png)Figure 10:Parameter efficiency at the clean baseline \(r=0%r=0\\%\)\.RMSE vs\. parameter count \(log scale\) for each dataset; gray circles are the 13 individual open\-weight judges, dashed line is their log\-linear scaling fit, and coloured stars mark the fourRoPoLLjuries at their aggregate parameter budget\. Clean counterpart of[Figures˜8](https://arxiv.org/html/2606.30931#S6.F8)and[9](https://arxiv.org/html/2606.30931#S6.F9)\.A natural concern about a robust aggregator is that the robustness costs accuracy in the*absence*of corruption\. Theorem[1](https://arxiv.org/html/2606.30931#Thmtheorem1)predicts a small insurance premium atα=0\\alpha=0\(the geometric constantCβ→1C\_\{\\beta\}\\to 1asβ→0\\beta\\to 0\);[Figure˜10](https://arxiv.org/html/2606.30931#S6.F10)cashes this empirically by plotting the fourRoPoLLcommittees against the1313\-judge individual scaling line atr=0%r=0\\%\. TheMedium,Mixed, andSmallcommittees sit below the individual scaling line on every benchmark;Tinyis roughly on\-trend\. The clean\-case insurance premium is at most\+6\.4%\+6\.4\\%relative RMSE across the full grid \(median\+0\.9%\+0\.9\\%\), so the cost of usingRoPoLLwhen corruption happens to be absent is a small fraction of the gains it delivers when corruption is present\.

### 6\.6Jury\-Size Ablation and Corruption\-Type Dependence

![Refer to caption](https://arxiv.org/html/2606.30931v1/x18.png)Figure 11:Jury\-size ablation: RMSE vs\. jury sizeNN\.Mean RMSE across sampledNN\-judge subcommittees from each tier pool, underzeros/inverted/bimodal\-randomcorruption\. Left column:r=0%r=0\\%; right column:r=30%r=30\\%\. Bands show±1\\pm 1standard deviation across combinations\.![Refer to caption](https://arxiv.org/html/2606.30931v1/x19.png)Figure 12:PoLLvs\.Medianvs\.RoPoLLdegradation curves\.RMSE vs\. per\-case corruption raterrfor theMediumjury, one panel per \(dataset×\\timescorruption type\)\. Solid =RoPoLL, dashed =PoLL, dotted = coordinate\-wiseMedian\.Two practical questions remain: how many judges doesRoPoLLactually need, and is the geometric median always the right choice?[Figure˜11](https://arxiv.org/html/2606.30931#S6.F11)answers the first by sweeping the jury sizeN∈\{1,2,3,4\}N\\in\\\{1,2,3,4\\\}across the four committee tiers under three corruption types at the clean baseline \(r=0%r=0\\%, left column\) and under heavy contamination \(r=30%r=30\\%, right column\)\.[Figure˜12](https://arxiv.org/html/2606.30931#S6.F12)answers the second by reporting the full three\-methodPoLL/Median/RoPoLLcomparison across every \(dataset, corruption type, rate\) cell\.

#### Jury ablation\.

RMSE drops sharply fromN=1N=1toN=3N=3and levels off thereafter on every tier and corruption type, both clean and at30%30\\%contamination; the marginal benefit of a fourth judge falls within the standard\-deviation band, confirming the Corollary[1](https://arxiv.org/html/2606.30931#Thmcorollary1)prediction that the three\-judge committees sit at the knee of the cost–accuracy frontier\.

#### Corruption\-type ablation\.

UnderzerosandinvertedPoLLis mean\-preserving on the bounded score scale and tracksRoPoLLwithin±0\.3\\pm 0\.3RMSE; underbimodal\-randommean\-preservation fails andRoPoLLstays belowPoLLat everyr≥10%r\\geq 10\\%; undercauchy\-farthe gap reaches one to three orders of magnitude \(see[Figure˜12](https://arxiv.org/html/2606.30931#S6.F12)\)\. The coordinate\-wiseMediantracksRoPoLLclosely on heavy\-tailed and bounded\-symmetric corruptions but lagsRoPoLLonbimodal\-random, where the cross\-dimensional structure \(Example[1](https://arxiv.org/html/2606.30931#Thmexample1)\) is invisible to a per\-coordinate median\. At the clean baseline,RoPoLLpays a small*insurance premium*\(\+0\.01%\+0\.01\\%to\+6\.4%\+6\.4\\%relative RMSE\)\.RoPoLLis a robust default for high\-penalty regimes\.

### 6\.7Noisy\-GT Control: Systematic Bias, Not Imprecision

A natural concern about robust aggregation is that the “insurance premium” might be paid on a phantom—if real judge failures are imprecise but unbiased rather than systematically wrong, robustness machinery is unnecessary\. We test this directly with a*Noisy\-GT*adversary that injects𝐲^noisy=clip​\(𝐲⋆\+ϵ,0,K\)\\hat\{\{\\mathbf\{y\}\}\}\_\{\\mathrm\{noisy\}\}=\\mathrm\{clip\}\(\{\\mathbf\{y\}\}^\{\\star\}\+\\bm\{\{\\epsilon\}\},0,K\)withϵ∼𝒩​\(𝟎,0\.82​𝐈\)\\bm\{\{\\epsilon\}\}\\sim\{\\mathcal\{N\}\}\(\{\\mathbf\{0\}\},0\.8^\{2\}\{\\mathbf\{I\}\}\)in place of the adversarial vectors of §[6\.1](https://arxiv.org/html/2606.30931#S6.SS1)\. Empirically, all three aggregators*improve*as the Noisy\-GT injection rate increases on both HelpSteer 2 and UltraFeedback, withPoLLslightly preferred \(because averaging unbiased noise is statistically optimal under Gaussian errors\)\. This rules out the most obvious confound: theRoPoLLpremium reported in §§[6\.2](https://arxiv.org/html/2606.30931#S6.SS2)–[6\.4](https://arxiv.org/html/2606.30931#S6.SS4)is paid against*biased*contamination, not imprecision\. The full per\-model and per\-dimension breakdowns supporting this control are in Appendix[B\.2](https://arxiv.org/html/2606.30931#A2.SS2)\.

### 6\.8Released Corpus

To support reproduction and follow\-up work, we release the full1313\-judge×\\timesthree\-benchmark output corpus that drives every figure in this section\. For each\(judge,sample\)\(\\mathrm\{judge\},\\,\\mathrm\{sample\}\)cell the corpus contains the parsed score vector𝐲^f​\(x\)∈ℝd\\hat\{\{\\mathbf\{y\}\}\}\_\{f\}\(x\)\\in\\mathbb\{R\}^\{d\}produced by the deterministic parserϕ\\phi\(Definition[4](https://arxiv.org/html/2606.30931#Thmdefinition4)\), the per\-call latency, and the reference label𝐲jref\{\\mathbf\{y\}\}^\{\\mathrm\{ref\}\}\_\{j\}\(Definition[2](https://arxiv.org/html/2606.30931#Thmdefinition2)\); parser\-failure cells are recorded as the all\-zeros fallback vector\. The corpus totals approximately28​K28\\mathrm\{K\}scored\(judge,sample\)\(\\mathrm\{judge\},\\,\\mathrm\{sample\}\)cells \(Table[2](https://arxiv.org/html/2606.30931#S6.T2)\), enabling exact reproduction of every reported figure without re\-running the inference cost\.

Table 2:Corpus\-level statistics\.NsampN\_\{\\mathrm\{samp\}\}: samples;\|J\|\|J\|: judge pool size;dd: target dimension;f¯\\bar\{f\},fmaxf\_\{\\max\}: mean and max per\-judge parser\-failure rate;smins\_\{\\min\},smaxs\_\{\\max\}: observed score range across all judges and samples \(negative values arise from HS 2 / HS 3 signed\-difference reductions on a small fraction of cells where parsed scores fell outside the rubric range\)\. For HS 3,f¯\\bar\{f\}andfmaxf\_\{\\max\}are computed over the full1616\-judge pool \(the1313open\-weight judges plus the three HS 3\-only Claude judges\); the1313\-judge common\-pool mean is3\.38%3\.38\\%\([Figure˜2](https://arxiv.org/html/2606.30931#S3.F2)\)\. HS 3 in the released JSON contains the100100\-sample preference slice used for the §[6](https://arxiv.org/html/2606.30931#S6)evaluation; the full 2017\-sample multilingual validation set is available on request\.#### Per\-attribute score distributions\.

[Figure˜13](https://arxiv.org/html/2606.30931#S6.F13)plots the score distributions per attribute \(per\-dataset\)\. HelpSteer 2 and UltraFeedback have substantial mass at the score extremes \(parser fallback at0; sycophantic judges concentrating at the maximum\), motivating thezerosandinvertedcorruption types used in §[6](https://arxiv.org/html/2606.30931#S6)\. HelpSteer 3, which reduces a five\-attribute pair of responses to a single signed\-preference scalar, is well\-centered on0with light tails, consistent with the cancellation of per\-attribute biases under the signed\-difference reduction\.

HelpSteer 2 ![Refer to caption](https://arxiv.org/html/2606.30931v1/x20.png)

UltraFeedback ![Refer to caption](https://arxiv.org/html/2606.30931v1/x21.png)

HelpSteer 3 ![Refer to caption](https://arxiv.org/html/2606.30931v1/x22.png)

Figure 13:Per\-attribute judge\-score distributions \(logyy\-axis\)\.HelpSteer 2 and UltraFeedback show heavy mass concentration at the score extremes—parser fallback at0and sycophantic saturation at the maximum—which motivates thezerosandinvertedcorruption types used in §[6](https://arxiv.org/html/2606.30931#S6)\. HelpSteer 3 \(signed\-preference scalar\) is centered on0with light tails, consistent with cancellation of per\-attribute biases under the signed\-difference reduction\.

### 6\.9Inter\-Judge Correlation Structure

![Refer to caption](https://arxiv.org/html/2606.30931v1/x23.png)

![Refer to caption](https://arxiv.org/html/2606.30931v1/x24.png)

![Refer to caption](https://arxiv.org/html/2606.30931v1/x25.png)

Figure 14:Inter\-judge Pearson correlation heatmaps \(lower\-triangle, annotated\)\.Pairwise correlations averaged over evaluation attributes; cells labelled with their numeric value\. Empirical mean off\-diagonal correlations:γ¯HS2=0\.49\\bar\{\\gamma\}\_\{\\mathrm\{HS2\}\}=0\.49,γ¯UF=0\.71\\bar\{\\gamma\}\_\{\\mathrm\{UF\}\}=0\.71,γ¯HS3=0\.49\\bar\{\\gamma\}\_\{\\mathrm\{HS3\}\}=0\.49\. These values support theγ∈\[0\.3,0\.5\]\\gamma\\in\[0\.3,0\.5\]assumption used in §[6\.1](https://arxiv.org/html/2606.30931#S6.SS1)to motivate three\-judge committees via Corollary[1](https://arxiv.org/html/2606.30931#Thmcorollary1); the higherγ¯UF\\bar\{\\gamma\}\_\{\\mathrm\{UF\}\}explains the smallerRoPoLL/PoLLgap observed on UltraFeedback\.[Figure˜14](https://arxiv.org/html/2606.30931#S6.F14)shows the pairwise Pearson correlation between every judge pair in the1313\-judge pool, averaged over attributes\. Empirical mean off\-diagonal correlations areγ¯HS2=0\.49\\bar\{\\gamma\}\_\{\\mathrm\{HS2\}\}=0\.49,γ¯HS3=0\.49\\bar\{\\gamma\}\_\{\\mathrm\{HS3\}\}=0\.49, andγ¯UF=0\.71\\bar\{\\gamma\}\_\{\\mathrm\{UF\}\}=0\.71\. These directly support the assumptionγ∈\[0\.3,0\.5\]\\gamma\\in\[0\.3,0\.5\]used in §[6\.1](https://arxiv.org/html/2606.30931#S6.SS1)to motivate the choiceN=3N=3: substituting the measuredγ¯\\bar\{\\gamma\}into the saturation lawNeff∞=1/γN\_\{\\mathrm\{eff\}\}^\{\\infty\}=1/\\gamma\(Corollary[1](https://arxiv.org/html/2606.30931#Thmcorollary1)\) yieldsNeff∞≈2\.0N\_\{\\mathrm\{eff\}\}^\{\\infty\}\\approx 2\.0on HS 2 and HS 3 and≈1\.4\\approx 1\.4on UltraFeedback, so the empirical diminishing\-returns knee atN=3N=3in[Figure˜11](https://arxiv.org/html/2606.30931#S6.F11)sits at or just past the saturation point predicted by the corpus’s actual correlation structure\.

The UltraFeedback correlationγ¯UF=0\.71\\bar\{\\gamma\}\_\{\\mathrm\{UF\}\}=0\.71is notably higher than the HelpSteer correlations\. This reflects the fact that UltraFeedback’s reference labels are themselves GPT\-4 annotations\(Cuiet al\.,[2024](https://arxiv.org/html/2606.30931#bib.bib49)\), so judges trained on similar rubric distributions converge to similar scores; the HelpSteer benchmarks use trained\-human annotators \(HelpSteer 2\) or pairwise human preferences \(HelpSteer 3\), producing more genuine inter\-judge variation\. This is consistent with the smallerRoPoLL/PoLLgap observed on UltraFeedback in §[6](https://arxiv.org/html/2606.30931#S6): when judges already agree, the difference between the mean and the geometric median is small\.

### 6\.10Empirical Indicator Correlationγ¯W\\bar\{\\gamma\}\_\{W\}

Lemma[3](https://arxiv.org/html/2606.30931#Thmlemma3)bounds the failure probability of theRoPoLLcluster event in terms of the*indicator correlation*γ¯W=meani≠j​Cov​\(Wi,Wj\)Var​\(Wi\)​Var​\(Wj\)\\bar\{\\gamma\}\_\{W\}=\\mathrm\{mean\}\_\{i\\neq j\}\\frac\{\\mathrm\{Cov\}\(W\_\{i\},W\_\{j\}\)\}\{\\sqrt\{\\mathrm\{Var\}\(W\_\{i\}\)\\mathrm\{Var\}\(W\_\{j\}\)\}\}of the cluster indicatorsWi=𝟙​\{Zi=0,‖𝐲^i−𝐲⋆‖2≤ρp\}W\_\{i\}=\\mathbb\{1\}\\\{Z\_\{i\}=0,\\ \\\|\\hat\{\{\\mathbf\{y\}\}\}\_\{i\}\-\{\\mathbf\{y\}\}^\{\\star\}\\\|\_\{2\}\\leq\\rho\_\{p\}\\\}\. This is in principle a finer object than the inter\-judge*score*correlationγ¯\\bar\{\\gamma\}of §[6\.9](https://arxiv.org/html/2606.30931#S6.SS9):γ¯\\bar\{\\gamma\}measures the linear correlation between raw score vectors, whileγ¯W\\bar\{\\gamma\}\_\{W\}measures the co\-incidence of two judges*both being competent and within the cluster ball*\. We estimateγ¯W\\bar\{\\gamma\}\_\{W\}directly on the experimental panels\.

#### Estimation procedure\.

For benchmarkb∈\{HS2,UF\}b\\in\\\{\\mathrm\{HS2\},\\mathrm\{UF\}\\\}: \(i\) for each\(judge​i,sample​s\)\(\\text\{judge \}i,\\text\{sample \}s\)cell, compute theℓ2\\ell\_\{2\}deviationδi\(s\)=‖𝐲^i\(s\)−𝐲⋆,\(s\)‖2\\delta\_\{i\}^\{\(s\)\}=\\\|\\hat\{\{\\mathbf\{y\}\}\}\_\{i\}^\{\(s\)\}\-\{\\mathbf\{y\}\}^\{\\star,\(s\)\}\\\|\_\{2\}\(parser\-failure cells contributeWi\(s\)=0W\_\{i\}^\{\(s\)\}=0\); \(ii\) select a cluster radiusρ\\rhoas thepp\-th quantile of pooled deviations\{δi\(s\)\}i,s\\\{\\delta\_\{i\}^\{\(s\)\}\\\}\_\{i,s\}; \(iii\) formWi\(s\)=𝟙​\{δi\(s\)≤ρ\}W\_\{i\}^\{\(s\)\}=\\mathbb\{1\}\\\{\\delta\_\{i\}^\{\(s\)\}\\leq\\rho\\\}; \(iv\) compute the mean off\-diagonal Pearson correlation of the rows ofW∈\{0,1\}N×SW\\in\\\{0,1\\\}^\{N\\times S\}\. We reportγ¯W\\bar\{\\gamma\}\_\{W\}at three radii \(p∈\{0\.50,0\.70,0\.90\}p\\in\\\{0\.50,0\.70,0\.90\\\}\) to show stability under the calibration choice\.

Table 3:Empirical indicator correlationγ¯W\\bar\{\\gamma\}\_\{W\}of Lemma[3](https://arxiv.org/html/2606.30931#Thmlemma3)on our1313\-judge experimental panels\.γ¯W\\bar\{\\gamma\}\_\{W\}is stable to within±0\.03\\pm 0\.03across cluster\-radius calibrations and lies in\[0\.45,0\.53\]\[0\.45,0\.53\]on both benchmarks, soNeff∈\[1\.45,1\.58\]N\_\{\\mathrm\{eff\}\}\\in\[1\.45,1\.58\]at the practical jury sizeN=3N\{=\}3\. The empiricalγ¯W\\bar\{\\gamma\}\_\{W\}is on the same order as the score correlationγ¯∈\[0\.49,0\.71\]\\bar\{\\gamma\}\\in\[0\.49,0\.71\]reported in[Figure˜14](https://arxiv.org/html/2606.30931#S6.F14); Pitt’s Gaussian correlation inequality\(Pitt,[1977](https://arxiv.org/html/2606.30931#bib.bib47); Esaryet al\.,[1967](https://arxiv.org/html/2606.30931#bib.bib45); Joag\-Dev and Proschan,[1983](https://arxiv.org/html/2606.30931#bib.bib46)\)gives the qualitative boundγ¯W≥0\\bar\{\\gamma\}\_\{W\}\\geq 0but not a quantitative comparison toγ¯\\bar\{\\gamma\}, so direct estimation is the right move\.
#### Implication for Lemma[3](https://arxiv.org/html/2606.30931#Thmlemma3)\.

The role of Lemma[3](https://arxiv.org/html/2606.30931#Thmlemma3)is structural: it shows that the geometric\-breakdown structure \(Cα\+βC\_\{\\alpha\+\\beta\}and the cluster radiusρ\\rho\) of Theorem[1](https://arxiv.org/html/2606.30931#Thmtheorem1)is preserved when the i\.i\.d\. assumption is replaced by an equicorrelated\-indicator hypothesis withγ¯W∈\[0,1\]\\bar\{\\gamma\}\_\{W\}\\in\[0,1\]\. The probability event delivered by the Chebyshev step,Pr⁡\[⋅\]≥1−1/\(β2​Neff\)\\Pr\[\\cdot\]\\geq 1\-1/\(\\beta^\{2\}N\_\{\\mathrm\{eff\}\}\), is informative in the large\-NeffN\_\{\\mathrm\{eff\}\}regime \(e\.g\., a hypothetical jury ofN=10N=10–3030judges withγ¯W≈0\.2\\bar\{\\gamma\}\_\{W\}\\approx 0\.2givesNeff∈\[3\.6,7\]N\_\{\\mathrm\{eff\}\}\\in\[3\.6,7\]andβ=0\.2\\beta=0\.2gives a non\-trivial bound\) but degenerates at smallNeffN\_\{\\mathrm\{eff\}\}, including the practicalNeff≈1\.5N\_\{\\mathrm\{eff\}\}\\approx 1\.5of ourN=3N=3panels\. This is a fundamental limit of variance\-only concentration at smallNN, not a slack in the analysis: with only∼1\.5\\sim 1\.5effective independent samples, no concentration argument can deliver a tight high\-probability bound, regardless of the estimator\. A Bernstein\-type bound under bounded\-covariance martingale structure \(Remark[20](https://arxiv.org/html/2606.30931#Thmremark20)\) would replaceβ−2\\beta^\{\-2\}withexp⁡\(−c​β2​Neff\)\\exp\(\-c\\beta^\{2\}N\_\{\\mathrm\{eff\}\}\)but does not materially help atNeff≈1\.5N\_\{\\mathrm\{eff\}\}\\approx 1\.5\. The practical value of Lemma[3](https://arxiv.org/html/2606.30931#Thmlemma3)for our small\-NNregime is therefore the structural guarantee, not the quantitative probability: the breakdown floor and the geometric constant are independent of this concentration argument and*are*the load\-bearing quantities for jury\-aggregation deployment\.

### 6\.11Practical Recommendation

UseRoPoLLas the default jury aggregator: the clean\-case insurance premium is small \(≤6%\\leq 6\\%relative RMSE, §[6\.5](https://arxiv.org/html/2606.30931#S6.SS5)\) and the threat to LLM juries is biased contamination rather than imprecision \(§[6\.7](https://arxiv.org/html/2606.30931#S6.SS7)\)\. The jury size is not a fixed prescription but follows from the saturation law of Corollary[1](https://arxiv.org/html/2606.30931#Thmcorollary1)\(NeffN\_\{\\mathrm\{eff\}\}saturates at1/γ1/\\gamma\): the cost–accuracy knee sits at whateverNNreaches that ceiling for the inter\-judge correlationγ\\gammaof the judge pool at hand\. For the diverse open\-weight pools studied here \(γ≈0\.49\\gamma\\approx 0\.49–0\.710\.71, §[6\.9](https://arxiv.org/html/2606.30931#S6.SS9)\) the knee falls atN≈3N\\approx 3\([Figure˜11](https://arxiv.org/html/2606.30931#S6.F11)\); a more orthogonal pool \(smallerγ\\gamma\) would push it higher, and a redundant one lower\. A controlled 2D synthetic visualisation of three representative failure modes, the per\-model and per\-dimension breakdowns, and the full extra\-metrics tables are in Appendices[B\.2](https://arxiv.org/html/2606.30931#A2.SS2)and[B\.1](https://arxiv.org/html/2606.30931#A2.SS1)\.

## 7Conclusion

We recast LLM\-jury aggregation as a robust mean\-estimation problem, showed thatPoLL\(Vergaet al\.,[2024](https://arxiv.org/html/2606.30931#bib.bib5)\)admits unbounded bias under any positive contamination \(Proposition[2](https://arxiv.org/html/2606.30931#Thmproposition2)\), and proposedRoPoLL: replace the mean with the geometric median\. Theorem[1](https://arxiv.org/html/2606.30931#Thmtheorem1)gives a finite\-sample upper bound; Lemma[3](https://arxiv.org/html/2606.30931#Thmlemma3)extends it to equicorrelated juries; Theorem[2](https://arxiv.org/html/2606.30931#Thmtheorem2)provides a matching minimax lower bound that aligns on the parametric rate and exposes ad\\sqrt\{d\}statistical–computational gap on the breakdown floor \(the price of GM’s polynomial\-time tractability vs\. the intractable Tukey halfspace median\)\. Empirically \(§[6](https://arxiv.org/html/2606.30931#S6)\),RoPoLLreducesPoLL’s RMSE by orders of magnitude on heavy\-tailed and cross\-dimensional attacks while paying≤6\.4%\\leq 6\.4\\%in clean\-baseline relative RMSE, and a33\-judgeRoPoLLcommittee at3838B beats Mistral\-Large\-3 \(675675B\) by1\.31×1\.31\\timeson HelpSteer 2 under30%30\\%bimodal\-randomcorruption:*robust aggregation, not the ensemble itself, delivers the win*\.

#### Scope and limitations\.

The theory holds the i\.i\.d\. baseline of Assumptions[2](https://arxiv.org/html/2606.30931#Thmassumption2)–[5](https://arxiv.org/html/2606.30931#Thmassumption5)fixed and partially relaxes independence via Lemma[3](https://arxiv.org/html/2606.30931#Thmlemma3); per\-judge heterogeneity \(σi,αi\\sigma\_\{i\},\\alpha\_\{i\}varying across44–675675B\), explicit dependence by design\(Liet al\.,[2024](https://arxiv.org/html/2606.30931#bib.bib11); Chanet al\.,[2024](https://arxiv.org/html/2606.30931#bib.bib12); Zhanget al\.,[2024](https://arxiv.org/html/2606.30931#bib.bib14)\), and tightening the contamination\-constant gap between Theorem[1](https://arxiv.org/html/2606.30931#Thmtheorem1)and Theorem[2](https://arxiv.org/html/2606.30931#Thmtheorem2)at finiteα\\alpharemain open\. Empirically, the corruption sweep is synthetic injection at a single rubric serialisation and temperature0, so it does not probe prompt\-format sensitivity\(Wanget al\.,[2023](https://arxiv.org/html/2606.30931#bib.bib6); Stureborget al\.,[2024](https://arxiv.org/html/2606.30931#bib.bib4)\); the Noisy\-GT control \(§[6\.7](https://arxiv.org/html/2606.30931#S6.SS7)\) rules out the obvious confound thatRoPoLL’s premium is paid against benign imprecision rather than biased contamination, but a large\-scale evaluation against*naturally occurring*judge failures on a downstream alignment task remains the most important next step\. A systematic comparison against the broader robust\-aggregation toolbox \(median\-of\-means, smoothed Tukey depth, learned calibration\) is also left open\.

#### Outlook\.

The corruption\-class diagnosis transfers verbatim to any pipeline where heterogeneous workers produce biased point\-mass errors at low rate—reward\-model ensembles for RLHF, synthetic\-data filtering juries, crowd annotation—suggesting the geometric median as a candidate default beyond LLM juries\.

## References

- A\. Acharya, A\. Hashemi, P\. Jain, S\. Sanghavi, I\. S\. Dhillon, and U\. Topcu \(2022\)Robust training in high dimensions via block coordinate geometric median descent\.InInternational Conference on Artificial Intelligence and Statistics,pp\. 11145–11168\.Cited by:[§1](https://arxiv.org/html/2606.30931#S1.SS0.SSS0.Px1.p2.4),[§2](https://arxiv.org/html/2606.30931#S2.p5.12),[§4\.2](https://arxiv.org/html/2606.30931#S4.SS2.p1.1)\.
- A\. Acharya, S\. Sanghavi, A\. Dimakis, and I\. S\. Dhillon \(2025\)Geometric median \(GM\) matching for robustkk\-subset selection from noisy data\.InInternational Conference on Machine Learning,pp\. 372–419\.Cited by:[§1](https://arxiv.org/html/2606.30931#S1.SS0.SSS0.Px1.p2.4),[§2](https://arxiv.org/html/2606.30931#S2.p5.12),[§4\.2](https://arxiv.org/html/2606.30931#S4.SS2.p1.1)\.
- A\. Acharya \(2025\)Robust and efficient learning in high dimensions from noisy data\.Ph\.D\. Thesis,The University of Texas at Austin\.Cited by:[§2](https://arxiv.org/html/2606.30931#S2.p5.12)\.
- G\. Aloupis \(2006\)Geometric measures of data depth\.DIMACS Series in Discrete Mathematics and Theoretical Computer Science72,pp\. 147–158\.Cited by:[§A\.9](https://arxiv.org/html/2606.30931#A1.SS9.SSS0.Px1.p1.15),[§5\.2](https://arxiv.org/html/2606.30931#S5.SS2.SSS0.Px1.p1.14)\.
- C\. Bajaj \(1988\)The algebraic degree of geometric optimization problems\.Discrete & Computational Geometry3\(2\),pp\. 177–191\.Cited by:[§4\.3](https://arxiv.org/html/2606.30931#S4.SS3.p1.1)\.
- P\. Billingsley \(1995\)Probability and measure\.3 edition,John Wiley & Sons,New York\.Cited by:[Definition 2](https://arxiv.org/html/2606.30931#Thmdefinition2.p1.12.12)\.
- P\. Blanchard, E\. M\. El Mhamdi, R\. Guerraoui, and J\. Stainer \(2017\)Machine learning with adversaries: Byzantine tolerant gradient descent\.InAdvances in Neural Information Processing Systems,Vol\.30\.Cited by:[§1](https://arxiv.org/html/2606.30931#S1.SS0.SSS0.Px1.p2.4),[§2](https://arxiv.org/html/2606.30931#S2.p6.5)\.
- S\. Boucheron, G\. Lugosi, and P\. Massart \(2013\)Concentration inequalities: a nonasymptotic theory of independence\.Oxford University Press\.Cited by:[§A\.6](https://arxiv.org/html/2606.30931#A1.SS6.SSS0.Px1.12.p12.3),[§A\.6](https://arxiv.org/html/2606.30931#A1.SS6.SSS0.Px1.7.p7.6)\.
- C\. Chan, W\. Chen, Y\. Su, J\. Yu, W\. Xue, S\. Zhang, J\. Fu, and Z\. Liu \(2024\)ChatEval: towards better LLM\-based evaluators through multi\-agent debate\.arXiv preprint arXiv:2308\.07201\.Cited by:[§1](https://arxiv.org/html/2606.30931#S1.p2.2),[§2](https://arxiv.org/html/2606.30931#S2.p3.3),[§5\.2](https://arxiv.org/html/2606.30931#S5.SS2.SSS0.Px2.p1.5),[§7](https://arxiv.org/html/2606.30931#S7.SS0.SSS0.Px1.p1.5)\.
- M\. Chen, C\. Gao, and Z\. Ren \(2018\)Robust covariance and scatter matrix estimation under huber’s contamination model\.The Annals of Statistics46\(5\),pp\. 1932–1960\.Cited by:[§A\.9](https://arxiv.org/html/2606.30931#A1.SS9.SSS0.Px1.p1.15),[§5\.2](https://arxiv.org/html/2606.30931#S5.SS2.SSS0.Px1.p1.14),[Remark 18](https://arxiv.org/html/2606.30931#Thmremark18.p1.12.12),[Remark 22](https://arxiv.org/html/2606.30931#Thmremark22.p1.11.11)\.
- K\. Cobbe, V\. Kosaraju, M\. Bavarian, M\. Chen, H\. Jun, L\. Kaiser, M\. Plappert, J\. Tworek, J\. Hilton, R\. Nakano,et al\.\(2021\)Training verifiers to solve math word problems\.arXiv preprint arXiv:2110\.14168\.Cited by:[§2](https://arxiv.org/html/2606.30931#S2.p3.3)\.
- G\. Cui, L\. Yuan, N\. Ding, G\. Yao, W\. Zhu, Y\. Ni, G\. Xie, Z\. Liu, and M\. Sun \(2024\)UltraFeedback: boosting language models with scaled ai feedback\.arXiv preprint arXiv:2310\.01377\.Cited by:[3rd item](https://arxiv.org/html/2606.30931#S1.I1.i3.p1.10),[§6\.1](https://arxiv.org/html/2606.30931#S6.SS1.SSS0.Px1.p1.8),[§6\.9](https://arxiv.org/html/2606.30931#S6.SS9.p2.1)\.
- D\. L\. Donoho and M\. Gasko \(1992\)Breakdown properties of location estimates based on halfspace depth and projected outlyingness\.The Annals of Statistics20\(4\),pp\. 1803–1827\.Cited by:[§A\.9](https://arxiv.org/html/2606.30931#A1.SS9.SSS0.Px1.p1.15),[§5\.2](https://arxiv.org/html/2606.30931#S5.SS2.SSS0.Px1.p1.14)\.
- Y\. Dubois, X\. Li, R\. Taori, T\. Zhang, I\. Gulrajani, J\. Ba, C\. Guestrin, P\. Liang, and T\. B\. Hashimoto \(2024\)AlpacaFarm: a simulation framework for methods that learn from human feedback\.Advances in Neural Information Processing Systems36\.Cited by:[§1](https://arxiv.org/html/2606.30931#S1.p1.1),[§2](https://arxiv.org/html/2606.30931#S2.p1.1)\.
- R\. M\. Dudley \(2002\)Real analysis and probability\.Cambridge Studies in Advanced Mathematics, Vol\.74,Cambridge University Press,Cambridge\.Cited by:[Definition 2](https://arxiv.org/html/2606.30931#Thmdefinition2.p1.12.12)\.
- E\. M\. El Mhamdi, R\. Guerraoui, and S\. Rouault \(2018\)The hidden vulnerability of distributed learning in Byzantium\.InInternational Conference on Machine Learning,pp\. 3521–3530\.Cited by:[§1](https://arxiv.org/html/2606.30931#S1.SS0.SSS0.Px1.p2.4),[§2](https://arxiv.org/html/2606.30931#S2.p6.5)\.
- J\. D\. Esary, F\. Proschan, and D\. W\. Walkup \(1967\)Association of random variables, with applications\.The Annals of Mathematical Statistics38\(5\),pp\. 1466–1474\.Cited by:[Table 3](https://arxiv.org/html/2606.30931#S6.T3),[Remark 21](https://arxiv.org/html/2606.30931#Thmremark21.p1.10.10)\.
- S\. B\. Hopkins \(2020\)Mean estimation with sub\-Gaussian rates in polynomial time\.The Annals of Statistics48\(2\),pp\. 1193–1213\.Cited by:[§4\.1](https://arxiv.org/html/2606.30931#S4.SS1.SSS0.Px2.p1.6)\.
- P\. J\. Huber \(1964\)Robust estimation of a location parameter\.The Annals of Mathematical Statistics35\(1\),pp\. 73–101\.Cited by:[§1](https://arxiv.org/html/2606.30931#S1.SS0.SSS0.Px1.p2.4),[§2](https://arxiv.org/html/2606.30931#S2.p5.12),[§4\.1](https://arxiv.org/html/2606.30931#S4.SS1.SSS0.Px1.p2.8)\.
- K\. Joag\-Dev and F\. Proschan \(1983\)Negative association of random variables, with applications\.The Annals of Statistics11\(1\),pp\. 286–295\.Cited by:[Table 3](https://arxiv.org/html/2606.30931#S6.T3),[Remark 21](https://arxiv.org/html/2606.30931#Thmremark21.p1.10.10)\.
- D\. S\. Johnson and F\. P\. Preparata \(1978\)The densest hemisphere problem\.Theoretical Computer Science6\(1\),pp\. 93–107\.Cited by:[§A\.9](https://arxiv.org/html/2606.30931#A1.SS9.SSS0.Px1.p1.15),[§5\.2](https://arxiv.org/html/2606.30931#S5.SS2.SSS0.Px1.p1.14)\.
- O\. Kallenberg \(2002\)Foundations of modern probability\.2 edition,Springer,New York\.Cited by:[Definition 2](https://arxiv.org/html/2606.30931#Thmdefinition2.p1.12.12)\.
- S\. Kim, J\. Shin, Y\. Cho, J\. Jang, S\. Longpre, H\. Lee, S\. Yun, S\. Shin, S\. Kim, J\. Thorne,et al\.\(2024\)Prometheus 2: an open source language model specialized in evaluating other language models\.arXiv preprint arXiv:2405\.01535\.Cited by:[§1](https://arxiv.org/html/2606.30931#S1.p1.1),[§2](https://arxiv.org/html/2606.30931#S2.p1.1)\.
- R\. Li, T\. Patel, and X\. Du \(2024\)PRD: peer rank and discussion improve large language model based evaluations\.Transactions on Machine Learning Research\.Note:External Links:ISSN 2835\-8856,[Link](https://openreview.net/forum?id=YVD1QqWRaj)Cited by:[§1](https://arxiv.org/html/2606.30931#S1.p2.2),[§2](https://arxiv.org/html/2606.30931#S2.p3.3),[§5\.2](https://arxiv.org/html/2606.30931#S5.SS2.SSS0.Px2.p1.5),[§7](https://arxiv.org/html/2606.30931#S7.SS0.SSS0.Px1.p1.5)\.
- X\. Li, T\. Zhang, Y\. Dubois, R\. Taori, I\. Gulrajani, C\. Guestrin, P\. Liang, and T\. B\. Hashimoto \(2023\)AlpacaEval: an automatic evaluator of instruction\-following models\.Note:[https://github\.com/tatsu\-lab/alpaca\_eval](https://github.com/tatsu-lab/alpaca_eval)Cited by:[§1](https://arxiv.org/html/2606.30931#S1.p1.1),[§2](https://arxiv.org/html/2606.30931#S2.p1.1)\.
- H\. P\. Lopuhaä and P\. J\. Rousseeuw \(1991\)Breakdown points of affine equivariant estimators of multivariate location and covariance matrices\.The Annals of Statistics19\(1\),pp\. 229–248\.Cited by:[§A\.3](https://arxiv.org/html/2606.30931#A1.SS3.6.p6.10),[§2](https://arxiv.org/html/2606.30931#S2.p5.12),[item 4](https://arxiv.org/html/2606.30931#S4.I1.i4.p1.2),[§4\.2](https://arxiv.org/html/2606.30931#S4.SS2.p1.1),[Definition 8](https://arxiv.org/html/2606.30931#Thmdefinition8.p1.9.9),[Lemma 1](https://arxiv.org/html/2606.30931#Thmlemma1.p1.7.8)\.
- G\. Lugosi and S\. Mendelson \(2019\)Sub\-Gaussian mean estimators\.The Annals of Statistics47\(2\),pp\. 783–794\.Cited by:[§1](https://arxiv.org/html/2606.30931#S1.SS0.SSS0.Px1.p2.4),[§2](https://arxiv.org/html/2606.30931#S2.p5.12),[§4\.1](https://arxiv.org/html/2606.30931#S4.SS1.SSS0.Px2.p1.6),[Remark 13](https://arxiv.org/html/2606.30931#Thmremark13.p1.3.2)\.
- P\. Massart \(2007\)Concentration inequalities and model selection: École d’Été de probabilités de saint\-flour xxxiii – 2003\.Springer\.Cited by:[§A\.9](https://arxiv.org/html/2606.30931#A1.SS9.3.p3.3)\.
- S\. Minsker \(2015\)Geometric median and robust estimation in Banach spaces\.Bernoulli21\(4\),pp\. 2308–2335\.Cited by:[§A\.5](https://arxiv.org/html/2606.30931#A1.SS5.1.p1.2),[§1](https://arxiv.org/html/2606.30931#S1.SS0.SSS0.Px1.p2.4),[§2](https://arxiv.org/html/2606.30931#S2.p5.12),[§5\.1](https://arxiv.org/html/2606.30931#S5.SS1.p1.1),[Lemma 1](https://arxiv.org/html/2606.30931#Thmlemma1.p1.7.8)\.
- A\. Panickssery, S\. R\. Bowman, and S\. Feng \(2024\)LLM evaluators recognize and favor their own generations\.InThe Thirty\-eighth Annual Conference on Neural Information Processing Systems,External Links:[Link](https://openreview.net/forum?id=4NJBV6Wp0h)Cited by:[§1](https://arxiv.org/html/2606.30931#S1.p1.1),[§2](https://arxiv.org/html/2606.30931#S2.p1.1)\.
- L\. D\. Pitt \(1977\)A gaussian correlation inequality for symmetric convex sets\.The Annals of Probability,pp\. 470–474\.Cited by:[Table 3](https://arxiv.org/html/2606.30931#S6.T3),[Remark 21](https://arxiv.org/html/2606.30931#Thmremark21.p1.10.10)\.
- R\. T\. Rockafellar \(1997\)Convex analysis\.Vol\.28,Princeton university press\.Cited by:[§A\.5](https://arxiv.org/html/2606.30931#A1.SS5.2.p2.9)\.
- K\. Saito, A\. Wachi, K\. Wataoka, and Y\. Akimoto \(2023\)Verbosity bias in preference labeling by large language models\.arXiv preprint arXiv:2310\.10076\.Cited by:[§1](https://arxiv.org/html/2606.30931#S1.p1.1),[§2](https://arxiv.org/html/2606.30931#S2.p1.1)\.
- C\. G\. Small \(1990\)A survey of multidimensional medians\.International Statistical Review58\(3\),pp\. 263–277\.Cited by:[§1](https://arxiv.org/html/2606.30931#S1.SS0.SSS0.Px1.p2.4),[§2](https://arxiv.org/html/2606.30931#S2.p5.12),[§4\.2](https://arxiv.org/html/2606.30931#S4.SS2.p1.1)\.
- R\. Stureborg, D\. Alikaniotis, and Y\. Suhara \(2024\)Large language models are inconsistent and biased evaluators\.arXiv preprint arXiv:2405\.01724\.Cited by:[§1](https://arxiv.org/html/2606.30931#S1.p1.1),[§2](https://arxiv.org/html/2606.30931#S2.p1.1),[§3\.4](https://arxiv.org/html/2606.30931#S3.SS4.SSS0.Px1.p1.8),[§7](https://arxiv.org/html/2606.30931#S7.SS0.SSS0.Px1.p1.5)\.
- A\. B\. Tsybakov \(2009\)Introduction to nonparametric estimation\.Springer\.Cited by:[§A\.9](https://arxiv.org/html/2606.30931#A1.SS9.1.p1.2),[§A\.9](https://arxiv.org/html/2606.30931#A1.SS9.4.p4.5)\.
- J\. W\. Tukey \(1960\)A survey of sampling from contaminated distributions\.Contributions to Probability and Statistics,pp\. 448–485\.Cited by:[§1](https://arxiv.org/html/2606.30931#S1.SS0.SSS0.Px1.p2.4),[§2](https://arxiv.org/html/2606.30931#S2.p5.12)\.
- J\. W\. Tukey \(1975\)Mathematics and the picturing of data\.InProceedings of the International Congress of Mathematicians,Vol\.2,pp\. 523–531\.Cited by:[§A\.9](https://arxiv.org/html/2606.30931#A1.SS9.SSS0.Px1.p1.15),[§5\.2](https://arxiv.org/html/2606.30931#S5.SS2.SSS0.Px1.p1.14)\.
- Y\. Vardi and C\. Zhang \(2000\)The multivariateL1L\_\{1\}\-median and associated data depth\.Proceedings of the National Academy of Sciences97\(4\),pp\. 1423–1426\.Cited by:[§A\.3](https://arxiv.org/html/2606.30931#A1.SS3.2.p2.8),[§A\.4](https://arxiv.org/html/2606.30931#A1.SS4.SSS0.Px1.p1.7),[§A\.4](https://arxiv.org/html/2606.30931#A1.SS4.SSS0.Px2.p1.4),[§A\.5](https://arxiv.org/html/2606.30931#A1.SS5.3.p3.11),[§1](https://arxiv.org/html/2606.30931#S1.SS0.SSS0.Px1.p2.4),[§2](https://arxiv.org/html/2606.30931#S2.p5.12),[§4\.2](https://arxiv.org/html/2606.30931#S4.SS2.p1.1),[§4\.3](https://arxiv.org/html/2606.30931#S4.SS3.SSS0.Px1.p1.7),[§4\.3](https://arxiv.org/html/2606.30931#S4.SS3.SSS0.Px2.p1.9),[§4\.3](https://arxiv.org/html/2606.30931#S4.SS3.p1.1)\.
- P\. Verga, S\. Hofstatter, S\. Althammer, Y\. Su, A\. Piktus, A\. Arkhangorodsky, M\. Xu, N\. White, and P\. Lewis \(2024\)Replacing judges with juries: evaluating llm generations with a panel of diverse models\.arXiv preprint arXiv:2404\.18796\.Cited by:[§1](https://arxiv.org/html/2606.30931#S1.p2.2),[§2](https://arxiv.org/html/2606.30931#S2.p2.1),[§3\.5](https://arxiv.org/html/2606.30931#S3.SS5.p2.1),[§6](https://arxiv.org/html/2606.30931#S6.p1.1),[§7](https://arxiv.org/html/2606.30931#S7.p1.7),[RoPoLL: Robust Panel of LLM Judges](https://arxiv.org/html/2606.30931#id1.p1.pic1.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.2.p2.14)\.
- R\. Vershynin \(2018\)High\-dimensional probability: an introduction with applications in data science\.Vol\.47,Cambridge university press\.Cited by:[§A\.6](https://arxiv.org/html/2606.30931#A1.SS6.SSS0.Px1.4.p4.9)\.
- P\. Wang, L\. Li, L\. Chen, Z\. Cai, D\. Zhu, B\. Lin, Y\. Cao, Q\. Liu, T\. Liu, and Z\. Sui \(2023\)Large language models are not fair evaluators\.arXiv preprint arXiv:2305\.17926\.Cited by:[§1](https://arxiv.org/html/2606.30931#S1.p1.1),[§2](https://arxiv.org/html/2606.30931#S2.p1.1),[§3\.4](https://arxiv.org/html/2606.30931#S3.SS4.SSS0.Px1.p1.8),[§7](https://arxiv.org/html/2606.30931#S7.SS0.SSS0.Px1.p1.5)\.
- Z\. Wang, Y\. Dong, O\. Delalleau, J\. Zeng, G\. Egert, P\. Zhang, A\. S\. Kamalakara, and O\. Kuchaiev \(2024\)HelpSteer2: open\-source dataset for training top\-performing reward models\.arXiv preprint arXiv:2406\.08673\.Cited by:[3rd item](https://arxiv.org/html/2606.30931#S1.I1.i3.p1.10),[§6\.1](https://arxiv.org/html/2606.30931#S6.SS1.SSS0.Px1.p1.8)\.
- Z\. Wang, J\. Zeng, O\. Delalleau, D\. Egert, E\. Evans, H\. Shin, F\. Soares, Y\. Dong, and O\. Kuchaiev \(2025\)HelpSteer3: human\-annotated feedback and edit data to empower inference\-time scaling in open\-ended general\-domain tasks\.InProceedings of the 63rd Annual Meeting of the Association for Computational Linguistics \(Volume 1: Long Papers\),W\. Che, J\. Nabende, E\. Shutova, and M\. T\. Pilehvar \(Eds\.\),Vienna, Austria,pp\. 25640–25662\.External Links:[Link](https://aclanthology.org/2025.acl-long.1246/),[Document](https://dx.doi.org/10.18653/v1/2025.acl-long.1246),ISBN 979\-8\-89176\-251\-0Cited by:[3rd item](https://arxiv.org/html/2606.30931#S1.I1.i3.p1.10),[§6\.1](https://arxiv.org/html/2606.30931#S6.SS1.SSS0.Px1.p1.8)\.
- E\. Weiszfeld \(1937\)Sur le point pour lequel la somme des distances dennpoints donnés est minimum\.Tohoku Mathematical Journal43,pp\. 355–386\.Cited by:[§A\.5](https://arxiv.org/html/2606.30931#A1.SS5.3.p3.11),[§4\.3](https://arxiv.org/html/2606.30931#S4.SS3.p1.1)\.
- S\. Ye, D\. Kim, S\. Kim, H\. Hwang, S\. Kim, Y\. Mun, J\. Lee, B\. Park, S\. Shin, S\. Kim,et al\.\(2024\)FLASK: fine\-grained language model evaluation based on alignment skill sets\.arXiv preprint arXiv:2307\.10928\.Cited by:[§1](https://arxiv.org/html/2606.30931#S1.p1.1),[§2](https://arxiv.org/html/2606.30931#S2.p1.1)\.
- D\. Yin, Y\. Chen, R\. Kannan, and P\. Bartlett \(2018\)Byzantine\-robust distributed learning: towards optimal statistical rates\.InInternational Conference on Machine Learning,pp\. 5650–5659\.Cited by:[§1](https://arxiv.org/html/2606.30931#S1.SS0.SSS0.Px1.p2.4),[§2](https://arxiv.org/html/2606.30931#S2.p6.5)\.
- X\. Zhang, B\. Yu, H\. Yu, Y\. Lv, T\. Liu, F\. Huang, H\. Xu, and Y\. Li \(2024\)Wider and deeper LLM networks are fairer LLM evaluators\.arXiv preprint arXiv:2407\.13275\.Cited by:[§1](https://arxiv.org/html/2606.30931#S1.p2.2),[§2](https://arxiv.org/html/2606.30931#S2.p2.1),[§5\.2](https://arxiv.org/html/2606.30931#S5.SS2.SSS0.Px2.p1.5),[§7](https://arxiv.org/html/2606.30931#S7.SS0.SSS0.Px1.p1.5)\.
- L\. Zheng, W\. Chiang, Y\. Sheng, S\. Zhuang, Z\. Wu, Y\. Zhuang, Z\. Lin, Z\. Li, D\. Li, E\. Xing,et al\.\(2023\)Judging llm\-as\-a\-judge with mt\-bench and chatbot arena\.Advances in neural information processing systems36,pp\. 46595–46623\.Cited by:[§1](https://arxiv.org/html/2606.30931#S1.p1.1),[§2](https://arxiv.org/html/2606.30931#S2.p1.1),[§2](https://arxiv.org/html/2606.30931#S2.p4.1)\.

Appendix

The appendix collects the deferred proofs and supporting material for the body of the paper\. The roadmap of formal results is in Table[1](https://arxiv.org/html/2606.30931#S4.T1)\(§[5](https://arxiv.org/html/2606.30931#S5)\); the appendix sections that follow are organised as Appendix[A](https://arxiv.org/html/2606.30931#A1)\(proofs for §[3](https://arxiv.org/html/2606.30931#S3), §[4](https://arxiv.org/html/2606.30931#S4), and §[5](https://arxiv.org/html/2606.30931#S5), including the matching minimax lower bound\), Appendix[B\.2](https://arxiv.org/html/2606.30931#A2.SS2)\(per\-model and per\-dimension breakdowns supporting §[6](https://arxiv.org/html/2606.30931#S6)\), and Appendix[B\.1](https://arxiv.org/html/2606.30931#A2.SS1)\(controlled 2D synthetic visualisation of five representative failure modes\)\.

## Appendix AComplete Proofs and Full Theoretical Development

### A\.1Proof of Proposition[1](https://arxiv.org/html/2606.30931#Thmproposition1)\(Variance Reduction\)

###### Proof of Proposition[1](https://arxiv.org/html/2606.30931#Thmproposition1)\.

Underαi=0\\alpha\_\{i\}=0, Assumption[2](https://arxiv.org/html/2606.30931#Thmassumption2)gives𝔼​\[𝐲^i∣𝐲⋆\]=𝐲⋆\\mathbb\{E\}\[\\hat\{\{\\mathbf\{y\}\}\}\_\{i\}\\mid\{\\mathbf\{y\}\}^\{\\star\}\]=\{\\mathbf\{y\}\}^\{\\star\}andCov​\(𝐲^i∣𝐲⋆\)=𝚺i\\mathrm\{Cov\}\(\\hat\{\{\\mathbf\{y\}\}\}\_\{i\}\\mid\{\\mathbf\{y\}\}^\{\\star\}\)=\{\\mathbf\{\\Sigma\}\}\_\{i\}\. Linearity of conditional expectation gives𝔼​\[𝐲^mean∣𝐲⋆\]=𝐲⋆\\mathbb\{E\}\[\\hat\{\{\\mathbf\{y\}\}\}\_\{\\mathrm\{mean\}\}\\mid\{\\mathbf\{y\}\}^\{\\star\}\]=\{\\mathbf\{y\}\}^\{\\star\}, and bilinearity of covariance gives \([10](https://arxiv.org/html/2606.30931#S3.E10)\)\. Independence \(Assumption[3](https://arxiv.org/html/2606.30931#Thmassumption3)\) zeroes the cross\-covariances, yielding the off\-diagonal vanishing in \([11](https://arxiv.org/html/2606.30931#S3.E11)\)\. Since the conditional error is centered,

𝔼​\[‖𝐲^mean−𝐲⋆‖22∣𝐲⋆\]=tr⁡\(Cov​\(𝐲^mean∣𝐲⋆\)\),\\mathbb\{E\}\[\\\|\\hat\{\{\\mathbf\{y\}\}\}\_\{\\mathrm\{mean\}\}\-\{\\mathbf\{y\}\}^\{\\star\}\\\|\_\{2\}^\{2\}\\mid\{\\mathbf\{y\}\}^\{\\star\}\]\\;=\\;\\operatorname\{tr\}\\\!\\left\(\\mathrm\{Cov\}\(\\hat\{\{\\mathbf\{y\}\}\}\_\{\\mathrm\{mean\}\}\\mid\{\\mathbf\{y\}\}^\{\\star\}\)\\right\),which is the second equation in \([11](https://arxiv.org/html/2606.30931#S3.E11)\)\. The final bound follows fromtr⁡\(𝚺i\)≤d​σ2\\operatorname\{tr\}\(\{\\mathbf\{\\Sigma\}\}\_\{i\}\)\\leq d\\sigma^\{2\}whenever𝚺i⪯σ2​𝐈d\{\\mathbf\{\\Sigma\}\}\_\{i\}\\preceq\\sigma^\{2\}\{\\mathbf\{I\}\}\_\{d\}\. ∎

###### Proof of Corollary[1](https://arxiv.org/html/2606.30931#Thmcorollary1)\.

Substituting the equicorrelated structureCov​\(𝐲^i,𝐲^j∣𝐲⋆\)=γ​𝚺\\mathrm\{Cov\}\(\\hat\{\{\\mathbf\{y\}\}\}\_\{i\},\\hat\{\{\\mathbf\{y\}\}\}\_\{j\}\\mid\{\\mathbf\{y\}\}^\{\\star\}\)=\\gamma\\,\{\\mathbf\{\\Sigma\}\}fori≠ji\\neq jandCov​\(𝐲^i∣𝐲⋆\)=𝚺\\mathrm\{Cov\}\(\\hat\{\{\\mathbf\{y\}\}\}\_\{i\}\\mid\{\\mathbf\{y\}\}^\{\\star\}\)=\{\\mathbf\{\\Sigma\}\}into \([10](https://arxiv.org/html/2606.30931#S3.E10)\) givesCov​\(𝐲^mean∣𝐲⋆\)=1\+\(N−1\)​γN​𝚺\\mathrm\{Cov\}\(\\hat\{\{\\mathbf\{y\}\}\}\_\{\\mathrm\{mean\}\}\\mid\{\\mathbf\{y\}\}^\{\\star\}\)=\\tfrac\{1\+\(N\-1\)\\gamma\}\{N\}\\,\{\\mathbf\{\\Sigma\}\}; taking traces yields the MSE expression\. ∎

### A\.2Proof of Proposition[2](https://arxiv.org/html/2606.30931#Thmproposition2)\(Unbounded Bias ofPoLL\)

For convenience we recall the statement: under Assumption[2](https://arxiv.org/html/2606.30931#Thmassumption2)and finite first momentsμiQ≜𝔼Qi​\[𝐲^i\]\{\\mathbf\{\\mu\}\}\_\{i\}^\{Q\}\\triangleq\\mathbb\{E\}\_\{Q\_\{i\}\}\[\\hat\{\{\\mathbf\{y\}\}\}\_\{i\}\], the mean’s conditional bias is

𝔼​\[𝐲^mean∣𝐲⋆\]−𝐲⋆=1N​∑i=1Nαi​\(μiQ−𝐲⋆\),\\mathbb\{E\}\\\!\\left\[\\hat\{\{\\mathbf\{y\}\}\}\_\{\\mathrm\{mean\}\}\\mid\{\\mathbf\{y\}\}^\{\\star\}\\right\]\-\{\\mathbf\{y\}\}^\{\\star\}\\;=\\;\\frac\{1\}\{N\}\\sum\_\{i=1\}^\{N\}\\alpha\_\{i\}\\\!\\left\(\{\\mathbf\{\\mu\}\}\_\{i\}^\{Q\}\-\{\\mathbf\{y\}\}^\{\\star\}\\right\),\(22\)and is not uniformly bounded over the corruption class as long asα\>0\\alpha\>0, regardless ofNN\.

###### Proof of Proposition[2](https://arxiv.org/html/2606.30931#Thmproposition2)\.

We prove the two claims in turn: the explicit bias formula \([22](https://arxiv.org/html/2606.30931#A1.E22)\), and the impossibility of a uniform bound over the corruption class\.

Step 1: Per\-judge expectation\.Fixi∈\[N\]i\\in\[N\]\. By Assumption[2](https://arxiv.org/html/2606.30931#Thmassumption2), conditional on𝐲⋆\{\\mathbf\{y\}\}^\{\\star\}the law of𝐲^i\\hat\{\{\\mathbf\{y\}\}\}\_\{i\}is the mixture\(1−αi\)​Pi\+αi​Qi\(1\-\\alpha\_\{i\}\)P\_\{i\}\+\\alpha\_\{i\}Q\_\{i\}with selectorZi∼Bernoulli​\(αi\)Z\_\{i\}\\sim\\mathrm\{Bernoulli\}\(\\alpha\_\{i\}\)\. By the law of total expectation,

𝔼​\[𝐲^i∣𝐲⋆\]\\displaystyle\\mathbb\{E\}\[\\hat\{\{\\mathbf\{y\}\}\}\_\{i\}\\mid\{\\mathbf\{y\}\}^\{\\star\}\]=\(1−αi\)​𝔼Pi​\[𝐲^i\]\+αi​𝔼Qi​\[𝐲^i\]\\displaystyle=\(1\-\\alpha\_\{i\}\)\\,\\mathbb\{E\}\_\{P\_\{i\}\}\[\\hat\{\{\\mathbf\{y\}\}\}\_\{i\}\]\+\\alpha\_\{i\}\\,\\mathbb\{E\}\_\{Q\_\{i\}\}\[\\hat\{\{\\mathbf\{y\}\}\}\_\{i\}\]=\(1−αi\)​𝐲⋆\+αi​μiQ,\\displaystyle=\(1\-\\alpha\_\{i\}\)\\,\{\\mathbf\{y\}\}^\{\\star\}\+\\alpha\_\{i\}\\,\{\\mathbf\{\\mu\}\}\_\{i\}^\{Q\},where the second equality uses𝔼Pi​\[𝐲^i\]=𝐲⋆\\mathbb\{E\}\_\{P\_\{i\}\}\[\\hat\{\{\\mathbf\{y\}\}\}\_\{i\}\]=\{\\mathbf\{y\}\}^\{\\star\}\(competent unbiasedness, Assumption[2](https://arxiv.org/html/2606.30931#Thmassumption2)\) and the finite\-first\-moment assumption onQiQ\_\{i\}to identify𝔼Qi​\[𝐲^i\]=μiQ\\mathbb\{E\}\_\{Q\_\{i\}\}\[\\hat\{\{\\mathbf\{y\}\}\}\_\{i\}\]=\{\\mathbf\{\\mu\}\}\_\{i\}^\{Q\}\. Rearranging,

𝔼​\[𝐲^i∣𝐲⋆\]−𝐲⋆=αi​\(μiQ−𝐲⋆\)\.\\mathbb\{E\}\[\\hat\{\{\\mathbf\{y\}\}\}\_\{i\}\\mid\{\\mathbf\{y\}\}^\{\\star\}\]\-\{\\mathbf\{y\}\}^\{\\star\}\\;=\\;\\alpha\_\{i\}\\,\(\{\\mathbf\{\\mu\}\}\_\{i\}^\{Q\}\-\{\\mathbf\{y\}\}^\{\\star\}\)\.\(23\)
Step 2: Linearity of the mean\.By the linearity of expectation applied to𝐲^mean=N−1​∑i=1N𝐲^i\\hat\{\{\\mathbf\{y\}\}\}\_\{\\mathrm\{mean\}\}=N^\{\-1\}\\sum\_\{i=1\}^\{N\}\\hat\{\{\\mathbf\{y\}\}\}\_\{i\},

𝔼​\[𝐲^mean∣𝐲⋆\]=1N​∑i=1N𝔼​\[𝐲^i∣𝐲⋆\]\.\\mathbb\{E\}\[\\hat\{\{\\mathbf\{y\}\}\}\_\{\\mathrm\{mean\}\}\\mid\{\\mathbf\{y\}\}^\{\\star\}\]\\;=\\;\\frac\{1\}\{N\}\\sum\_\{i=1\}^\{N\}\\mathbb\{E\}\[\\hat\{\{\\mathbf\{y\}\}\}\_\{i\}\\mid\{\\mathbf\{y\}\}^\{\\star\}\]\.Substituting \([23](https://arxiv.org/html/2606.30931#A1.E23)\) yields \([22](https://arxiv.org/html/2606.30931#A1.E22)\), proving the first claim\.

Step 3: Adversarial corruption distribution\.Supposeα=N−1​∑iαi\>0\\alpha=N^\{\-1\}\\sum\_\{i\}\\alpha\_\{i\}\>0\. Then there exists at least one indexi0∈\[N\]i\_\{0\}\\in\[N\]withαi0\>0\\alpha\_\{i\_\{0\}\}\>0\. LetB\>0B\>0be arbitrary,𝐞1\{\\mathbf\{e\}\}\_\{1\}be the first standard basis vector, and consider the adversarial choice

Qi0=δ𝐲⋆\+\(N​B/αi0\)​𝐞1,Q\_\{i\_\{0\}\}\\;=\\;\\delta\_\{\{\\mathbf\{y\}\}^\{\\star\}\+\(NB/\\alpha\_\{i\_\{0\}\}\)\\,\{\\mathbf\{e\}\}\_\{1\}\},\(24\)the Dirac mass placed at the indicated point; take\{Qi\}i≠i0\\\{Q\_\{i\}\\\}\_\{i\\neq i\_\{0\}\}to be any distributions withμiQ=𝐲⋆\{\\mathbf\{\\mu\}\}\_\{i\}^\{Q\}=\{\\mathbf\{y\}\}^\{\\star\}\(e\.g\.,Qi=PiQ\_\{i\}=P\_\{i\}itself, which gives zero contribution to the bias\)\. Thenμi0Q=𝐲⋆\+\(N​B/αi0\)​𝐞1\{\\mathbf\{\\mu\}\}\_\{i\_\{0\}\}^\{Q\}=\{\\mathbf\{y\}\}^\{\\star\}\+\(NB/\\alpha\_\{i\_\{0\}\}\)\\,\{\\mathbf\{e\}\}\_\{1\}, and \([22](https://arxiv.org/html/2606.30931#A1.E22)\) reduces to

𝔼​\[𝐲^mean∣𝐲⋆\]−𝐲⋆\\displaystyle\\mathbb\{E\}\[\\hat\{\{\\mathbf\{y\}\}\}\_\{\\mathrm\{mean\}\}\\mid\{\\mathbf\{y\}\}^\{\\star\}\]\-\{\\mathbf\{y\}\}^\{\\star\}=1N​αi0​\(μi0Q−𝐲⋆\)\\displaystyle=\\frac\{1\}\{N\}\\,\\alpha\_\{i\_\{0\}\}\\,\(\{\\mathbf\{\\mu\}\}\_\{i\_\{0\}\}^\{Q\}\-\{\\mathbf\{y\}\}^\{\\star\}\)=1N​αi0​N​Bαi0​𝐞1=B​𝐞1\.\\displaystyle=\\frac\{1\}\{N\}\\,\\alpha\_\{i\_\{0\}\}\\,\\frac\{NB\}\{\\alpha\_\{i\_\{0\}\}\}\\,\{\\mathbf\{e\}\}\_\{1\}\\;=\\;B\\,\{\\mathbf\{e\}\}\_\{1\}\.Hence∥𝔼\[𝐲^mean∣𝐲⋆\]−𝐲⋆∥2=B\\big\\\|\\mathbb\{E\}\[\\hat\{\{\\mathbf\{y\}\}\}\_\{\\mathrm\{mean\}\}\\mid\{\\mathbf\{y\}\}^\{\\star\}\]\-\{\\mathbf\{y\}\}^\{\\star\}\\big\\\|\_\{2\}=B\.

Step 4: Conclusion\.SinceB\>0B\>0was arbitrary, no constantC​\(α,N,d,σ\)C\(\\alpha,N,d,\\sigma\)depending only on the model parameters of Assumptions[2](https://arxiv.org/html/2606.30931#Thmassumption2)–[5](https://arxiv.org/html/2606.30931#Thmassumption5)can satisfy

sup\{Qi\}∥𝔼\[𝐲^mean∣𝐲⋆\]−𝐲⋆∥2≤C\(α,N,d,σ\)\.\\sup\_\{\\\{Q\_\{i\}\\\}\}\\,\\big\\\|\\mathbb\{E\}\[\\hat\{\{\\mathbf\{y\}\}\}\_\{\\mathrm\{mean\}\}\\mid\{\\mathbf\{y\}\}^\{\\star\}\]\-\{\\mathbf\{y\}\}^\{\\star\}\\big\\\|\_\{2\}\\;\\leq\\;C\(\\alpha,N,d,\\sigma\)\.The bias is therefore unbounded over the corruption class for every fixedNN, completing the proof\. ∎

### A\.3Proof of Proposition[3](https://arxiv.org/html/2606.30931#Thmproposition3)

###### Proof of Proposition[3](https://arxiv.org/html/2606.30931#Thmproposition3)\.

\(i\) Existence\.Each summand𝐳↦‖𝐳−𝐲^i‖2\{\\mathbf\{z\}\}\\mapsto\\\|\{\\mathbf\{z\}\}\-\\hat\{\{\\mathbf\{y\}\}\}\_\{i\}\\\|\_\{2\}is the Euclidean norm of an affine function of𝐳\{\\mathbf\{z\}\}, hence continuous and convex \(see any standard reference on convex analysis\)\. Sums of continuous convex functions are continuous and convex, soFFis continuous and convex\. For coercivity, fix any data point𝐲^1\\hat\{\{\\mathbf\{y\}\}\}\_\{1\}; by the reverse triangle inequality

F​\(𝐳\)≥‖𝐳−𝐲^1‖2≥‖𝐳‖2−‖𝐲^1‖2→∞as​‖𝐳‖2→∞\.F\(\{\\mathbf\{z\}\}\)\\;\\geq\\;\\\|\{\\mathbf\{z\}\}\-\\hat\{\{\\mathbf\{y\}\}\}\_\{1\}\\\|\_\{2\}\\;\\geq\\;\\\|\{\\mathbf\{z\}\}\\\|\_\{2\}\-\\\|\\hat\{\{\\mathbf\{y\}\}\}\_\{1\}\\\|\_\{2\}\\;\\to\\;\\infty\\quad\\text\{as \}\\\|\{\\mathbf\{z\}\}\\\|\_\{2\}\\to\\infty\.SinceFFis continuous and coercive, the sublevel set\{𝐳:F​\(𝐳\)≤F​\(𝟎\)\}\\\{\{\\mathbf\{z\}\}:F\(\{\\mathbf\{z\}\}\)\\leq F\(\{\\mathbf\{0\}\}\)\\\}is nonempty, closed, and bounded, hence compact inℝd\\mathbb\{R\}^\{d\}\. Weierstrass’s theorem then yields a minimizer\.

\(ii\) Uniqueness\.The function𝐳↦‖𝐳−𝐲^i‖2\{\\mathbf\{z\}\}\\mapsto\\\|\{\\mathbf\{z\}\}\-\\hat\{\{\\mathbf\{y\}\}\}\_\{i\}\\\|\_\{2\}is strictly convex on every line not passing through𝐲^i\\hat\{\{\\mathbf\{y\}\}\}\_\{i\}and affine on the line through𝐲^i\\hat\{\{\\mathbf\{y\}\}\}\_\{i\}in the direction of any other point\. Suppose the data are not collinear: then for any lineℒ⊂ℝd\{\\mathcal\{L\}\}\\subset\\mathbb\{R\}^\{d\}there exists at least one𝐲^i∉ℒ\\hat\{\{\\mathbf\{y\}\}\}\_\{i\}\\notin\{\\mathcal\{L\}\}, so the corresponding summand is strictly convex alongℒ\{\\mathcal\{L\}\}\. HenceFFis strictly convex along every line, hence strictly convex onℝd\\mathbb\{R\}^\{d\}, and the minimizer is unique\(Vardi and Zhang,[2000](https://arxiv.org/html/2606.30931#bib.bib28)\)\.

\(iii\) Affine equivariance\.Let𝐔∈ℝd×d\{\\mathbf\{U\}\}\\in\\mathbb\{R\}^\{d\\times d\}be orthogonal and𝐛∈ℝd\{\\mathbf\{b\}\}\\in\\mathbb\{R\}^\{d\}\. For all𝐳∈ℝd\{\\mathbf\{z\}\}\\in\\mathbb\{R\}^\{d\},

‖𝐔𝐳\+𝐛−\(𝐔​𝐲^i\+𝐛\)‖2=‖𝐔​\(𝐳−𝐲^i\)‖2=‖𝐳−𝐲^i‖2,\\\|\{\\mathbf\{U\}\}\{\\mathbf\{z\}\}\+\{\\mathbf\{b\}\}\-\(\{\\mathbf\{U\}\}\\hat\{\{\\mathbf\{y\}\}\}\_\{i\}\+\{\\mathbf\{b\}\}\)\\\|\_\{2\}\\;=\\;\\\|\{\\mathbf\{U\}\}\(\{\\mathbf\{z\}\}\-\\hat\{\{\\mathbf\{y\}\}\}\_\{i\}\)\\\|\_\{2\}\\;=\\;\\\|\{\\mathbf\{z\}\}\-\\hat\{\{\\mathbf\{y\}\}\}\_\{i\}\\\|\_\{2\},where the second equality uses𝐔⊤​𝐔=𝐈d\{\\mathbf\{U\}\}^\{\\top\}\{\\mathbf\{U\}\}=\{\\mathbf\{I\}\}\_\{d\}\. Summing overii,F𝐔,𝐛​\(𝐔𝐳\+𝐛\)=F​\(𝐳\)F^\{\{\\mathbf\{U\}\},\{\\mathbf\{b\}\}\}\(\{\\mathbf\{U\}\}\{\\mathbf\{z\}\}\+\{\\mathbf\{b\}\}\)=F\(\{\\mathbf\{z\}\}\)whereF𝐔,𝐛F^\{\{\\mathbf\{U\}\},\{\\mathbf\{b\}\}\}is the objective on the transformed sample\. The map𝐳↦𝐔𝐳\+𝐛\{\\mathbf\{z\}\}\\mapsto\{\\mathbf\{U\}\}\{\\mathbf\{z\}\}\+\{\\mathbf\{b\}\}is a bijection onℝd\\mathbb\{R\}^\{d\}, so the two minimizers are related by exactly this transformation\.

\(iv\) Breakdown point\.We show that the GM tolerates any corruption of strictly fewer than⌈N/2⌉\\lceil N/2\\rceilpoints and that this threshold is tight\.

*Sufficiency\.*Supposem<⌈N/2⌉m<\\lceil N/2\\rceilpoints are arbitrarily replaced and denote the corrupted sample𝐲^1:N′\\hat\{\{\\mathbf\{y\}\}\}^\{\\prime\}\_\{1:N\}\. The competent setS=\{i:𝐲^i′=𝐲^i\}S=\\\{i:\\hat\{\{\\mathbf\{y\}\}\}^\{\\prime\}\_\{i\}=\\hat\{\{\\mathbf\{y\}\}\}\_\{i\}\\\}has\|S\|=N−m\>N/2\|S\|=N\-m\>N/2, hence\|S\|\>\|Sc\|\|S\|\>\|S^\{c\}\|\. Let𝐳′=GM​\(𝐲^1:N′\)\{\\mathbf\{z\}\}^\{\\prime\}=\\mathrm\{GM\}\(\\hat\{\{\\mathbf\{y\}\}\}^\{\\prime\}\_\{1:N\}\)be the corrupted GM\. By the subgradient optimality condition for the convex objectiveF′F^\{\\prime\},

𝟎∈∂F′​\(𝐳′\)=∑i:𝐳′≠𝐲^i′𝐳′−𝐲^i′‖𝐳′−𝐲^i′‖2\+\(ball terms for ties\)\.\{\\mathbf\{0\}\}\\in\\partial F^\{\\prime\}\(\{\\mathbf\{z\}\}^\{\\prime\}\)=\\sum\_\{i:\{\\mathbf\{z\}\}^\{\\prime\}\\neq\\hat\{\{\\mathbf\{y\}\}\}^\{\\prime\}\_\{i\}\}\\frac\{\{\\mathbf\{z\}\}^\{\\prime\}\-\\hat\{\{\\mathbf\{y\}\}\}^\{\\prime\}\_\{i\}\}\{\\\|\{\\mathbf\{z\}\}^\{\\prime\}\-\\hat\{\{\\mathbf\{y\}\}\}^\{\\prime\}\_\{i\}\\\|\_\{2\}\}\+\(\\text\{ball terms for ties\}\)\.Each unit\-vector term has norm11\. If‖𝐳′‖2\\\|\{\\mathbf\{z\}\}^\{\\prime\}\\\|\_\{2\}were unbounded as the adversary varies the corrupted points within theirmm\-coordinate budget, then for the competent pointsi∈Si\\in Sthe unit vectors\(𝐳′−𝐲^i\)/‖𝐳′−𝐲^i‖2\(\{\\mathbf\{z\}\}^\{\\prime\}\-\\hat\{\{\\mathbf\{y\}\}\}\_\{i\}\)/\\\|\{\\mathbf\{z\}\}^\{\\prime\}\-\\hat\{\{\\mathbf\{y\}\}\}\_\{i\}\\\|\_\{2\}would all lie in a small cone \(all pointing approximately from the bounded competent cluster toward𝐳′\{\\mathbf\{z\}\}^\{\\prime\}\), so their sum has norm at least\|S\|​\(1−o​\(1\)\)\|S\|\(1\-o\(1\)\)\. The corrupted contribution has norm at most\|Sc\|<\|S\|\|S^\{c\}\|<\|S\|, hence the total subgradient has norm at least\|S\|−\|Sc\|\>0\|S\|\-\|S^\{c\}\|\>0, contradicting the optimality𝟎∈∂F′​\(𝐳′\)\{\\mathbf\{0\}\}\\in\\partial F^\{\\prime\}\(\{\\mathbf\{z\}\}^\{\\prime\}\)\. Therefore‖𝐳′‖2\\\|\{\\mathbf\{z\}\}^\{\\prime\}\\\|\_\{2\}remains bounded, i\.e\. nomm\-budget corruption can drive the GM to infinity\.

*Necessity\.*Withm=⌈N/2⌉m=\\lceil N/2\\rceilcorrupted points all placed at a common location𝐲^i0′=M⋅𝐞1\\hat\{\{\\mathbf\{y\}\}\}^\{\\prime\}\_\{i\_\{0\}\}=M\\cdot\{\\mathbf\{e\}\}\_\{1\}for arbitrarily largeMM, the corrupted set forms a majority \(or tie ifNNis even\) and the GM moves to withinO​\(1\)O\(1\)ofM​𝐞1M\\,\{\\mathbf\{e\}\}\_\{1\}asM→∞M\\to\\infty\(Lopuhaä and Rousseeuw,[1991](https://arxiv.org/html/2606.30931#bib.bib26)\)\. Hence the breakdown point is exactlyϵ⋆=⌈N/2⌉/N\{\\epsilon\}^\{\\star\}=\\lceil N/2\\rceil/N, which tends to1/21/2asN→∞N\\to\\infty\. This is the optimal breakdown for any translation\-equivariant estimator\(Lopuhaä and Rousseeuw,[1991](https://arxiv.org/html/2606.30931#bib.bib26)\)\. ∎

### A\.4Weiszfeld Iteration: Full Derivation, Convergence, and Cost

For completeness, this subsection gives the full derivation, convergence statement, and cost analysis for the Weiszfeld iteration sketched in §[4\.3](https://arxiv.org/html/2606.30931#S4.SS3)\.

#### Derivation\.

At a non\-data point𝐳≠𝐲^i\{\\mathbf\{z\}\}\\neq\\hat\{\{\\mathbf\{y\}\}\}\_\{i\}for allii, the gradient of the GM objectiveF​\(𝐳\)=∑i‖𝐳−𝐲^i‖2F\(\{\\mathbf\{z\}\}\)=\\sum\_\{i\}\\\|\{\\mathbf\{z\}\}\-\\hat\{\{\\mathbf\{y\}\}\}\_\{i\}\\\|\_\{2\}is

∇F​\(𝐳\)=∑i=1N𝐳−𝐲^i‖𝐳−𝐲^i‖2\.\\nabla F\(\{\\mathbf\{z\}\}\)=\\sum\_\{i=1\}^\{N\}\\frac\{\{\\mathbf\{z\}\}\-\\hat\{\{\\mathbf\{y\}\}\}\_\{i\}\}\{\\\|\{\\mathbf\{z\}\}\-\\hat\{\{\\mathbf\{y\}\}\}\_\{i\}\\\|\_\{2\}\}\.\(25\)Setting∇F​\(𝐳\)=𝟎\\nabla F\(\{\\mathbf\{z\}\}\)=\{\\mathbf\{0\}\}and rearranging gives the fixed\-point equation \([15](https://arxiv.org/html/2606.30931#S4.E15)\) of §[4\.3](https://arxiv.org/html/2606.30931#S4.SS3),

𝐳=∑i=1N𝐲^i/‖𝐳−𝐲^i‖2∑i=1N1/‖𝐳−𝐲^i‖2,\{\\mathbf\{z\}\}\\;=\\;\\frac\{\\sum\_\{i=1\}^\{N\}\\hat\{\{\\mathbf\{y\}\}\}\_\{i\}/\\\|\{\\mathbf\{z\}\}\-\\hat\{\{\\mathbf\{y\}\}\}\_\{i\}\\\|\_\{2\}\}\{\\sum\_\{i=1\}^\{N\}1/\\\|\{\\mathbf\{z\}\}\-\\hat\{\{\\mathbf\{y\}\}\}\_\{i\}\\\|\_\{2\}\},which is the Weiszfeld iteration𝐳←T​\(𝐳\)\{\\mathbf\{z\}\}\\leftarrow T\(\{\\mathbf\{z\}\}\)\. When the current iterate coincides with a data point𝐲^j\\hat\{\{\\mathbf\{y\}\}\}\_\{j\}, the denominator‖𝐳−𝐲^j‖2=0\\\|\{\\mathbf\{z\}\}\-\\hat\{\{\\mathbf\{y\}\}\}\_\{j\}\\\|\_\{2\}=0creates a singularity; the modified step ofVardi and Zhang \([2000](https://arxiv.org/html/2606.30931#bib.bib28)\)replaces the weight by

wi\(t\)=1max⁡\(‖𝐳\(t\)−𝐲^i‖2,η\)w\_\{i\}^\{\(t\)\}=\\frac\{1\}\{\\max\\\!\\left\(\\\|\{\\mathbf\{z\}\}^\{\(t\)\}\-\\hat\{\{\\mathbf\{y\}\}\}\_\{i\}\\\|\_\{2\},\\;\\eta\\right\)\}\(26\)for a small stability parameterη\>0\\eta\>0, recovering Algorithm[1](https://arxiv.org/html/2606.30931#alg1)\.

#### Convergence\.

Vardi and Zhang \([2000](https://arxiv.org/html/2606.30931#bib.bib28)\)prove that the modified Weiszfeld iteration converges to the unique geometric median at a linear rate whenever the data are not collinear: there existsρ∈\(0,1\)\\rho\\in\(0,1\)depending on the data configuration with‖𝐳\(t\)−𝐲^GM‖2≤ρt​‖𝐳\(0\)−𝐲^GM‖2\\\|\{\\mathbf\{z\}\}^\{\(t\)\}\-\\hat\{\{\\mathbf\{y\}\}\}\_\{\\mathrm\{GM\}\}\\\|\_\{2\}\\leq\\rho^\{t\}\\\|\{\\mathbf\{z\}\}^\{\(0\)\}\-\\hat\{\{\\mathbf\{y\}\}\}\_\{\\mathrm\{GM\}\}\\\|\_\{2\}\. The number of iterations to reach toleranceϵ\{\\epsilon\}is thereforeO​\(log⁡\(1/ϵ\)\)O\(\\log\(1/\{\\epsilon\}\)\)\.

#### Cost\.

Each iteration computesNNEuclidean distances inℝd\\mathbb\{R\}^\{d\}and one weighted average, costingO​\(N​d\)O\(Nd\)arithmetic operations\. WithO​\(log⁡\(1/ϵ\)\)O\(\\log\(1/\{\\epsilon\}\)\)iterations the total cost isO​\(N​d​log⁡\(1/ϵ\)\)O\(Nd\\log\(1/\{\\epsilon\}\)\)\. For typical LLM juries \(N≤20N\\leq 20,d≤5d\\leq 5,ϵ=10−8\{\\epsilon\}=10^\{\-8\}\) this amounts to a few hundred floating\-point operations—microseconds on any modern processor, while a single LLM judge invocation costs seconds of GPU time\. The aggregation step is computationally negligible relative to the inference cost of the jury\.

### A\.5Proof of Lemma[1](https://arxiv.org/html/2606.30931#Thmlemma1)

For convenience, we recall Lemma[1](https://arxiv.org/html/2606.30931#Thmlemma1): letx1,…,xk∈ℝdx\_\{1\},\\ldots,x\_\{k\}\\in\\mathbb\{R\}^\{d\}and letx∗x\_\{\*\}be any minimizer ofz↦∑j=1k‖z−xj‖2z\\mapsto\\sum\_\{j=1\}^\{k\}\\\|z\-x\_\{j\}\\\|\_\{2\}; fixα∈\(0,1/2\)\\alpha\\in\(0,1/2\),r\>0r\>0,z∈ℝdz\\in\\mathbb\{R\}^\{d\}\. If\|\{j:‖xj−z‖2≤r\}\|≥\(1−α\)​k\|\\\{j:\\\|x\_\{j\}\-z\\\|\_\{2\}\\leq r\\\}\|\\geq\(1\-\\alpha\)k, then‖x∗−z‖2≤Cα​r\\\|x\_\{\*\}\-z\\\|\_\{2\}\\leq C\_\{\\alpha\}\\,rwithCα=\(1−α\)/1−2​αC\_\{\\alpha\}=\(1\-\\alpha\)/\\sqrt\{1\-2\\alpha\}\.

###### Proof of Lemma[1](https://arxiv.org/html/2606.30931#Thmlemma1)\.

We give the proof ofMinsker \([2015](https://arxiv.org/html/2606.30931#bib.bib30)\), with the geometric setup made explicit\. The argument is by contradiction: assume‖x∗−z‖2\>Cα​r\\\|x\_\{\*\}\-z\\\|\_\{2\}\>C\_\{\\alpha\}rand derive a violation of the optimality ofx∗x\_\{\*\}\.

For brevity writeΔ≜‖x∗−z‖2\\Delta\\triangleq\\\|x\_\{\*\}\-z\\\|\_\{2\}and letF​\(y\)≜∑j=1k‖y−xj‖2F\(y\)\\triangleq\\sum\_\{j=1\}^\{k\}\\\|y\-x\_\{j\}\\\|\_\{2\}denote the geometric\-median objective\. Sincex∗x\_\{\*\}minimizes the convex functionFFonℝd\\mathbb\{R\}^\{d\}, the one\-sided directional derivative ofFFatx∗x\_\{\*\}in any directionv∈ℝdv\\in\\mathbb\{R\}^\{d\}is non\-negative \(standard convex analysis; see e\.g\.Rockafellar,[1997](https://arxiv.org/html/2606.30931#bib.bib20), Theorem 23\.1\)\. Takingv≜z−x∗v\\triangleq z\-x\_\{\*\}:

D​F​\(x∗;v\)≜limt↓0F​\(x∗\+t​v\)−F​\(x∗\)t≥0\.DF\(x\_\{\*\};v\)\\;\\triangleq\\;\\lim\_\{t\\downarrow 0\}\\,\\frac\{F\(x\_\{\*\}\+tv\)\-F\(x\_\{\*\}\)\}\{t\}\\;\\geq\\;0\.\(27\)
Step 1: Compute the directional derivative\.The functiony↦‖y−xj‖2y\\mapsto\\\|y\-x\_\{j\}\\\|\_\{2\}is the Euclidean norm of an affine function; it is differentiable at anyy≠xjy\\neq x\_\{j\}with gradient\(y−xj\)/‖y−xj‖2\(y\-x\_\{j\}\)/\\\|y\-x\_\{j\}\\\|\_\{2\}\(the Fermat–Weber gradient, classical; cf\.Weiszfeld,[1937](https://arxiv.org/html/2606.30931#bib.bib29); Vardi and Zhang,[2000](https://arxiv.org/html/2606.30931#bib.bib28)\)\. Forjjwithxj=x∗x\_\{j\}=x\_\{\*\}, the directional derivative ofy↦‖y−x∗‖2y\\mapsto\\\|y\-x\_\{\*\}\\\|\_\{2\}atx∗x\_\{\*\}in directionvvequals‖v‖2\\\|v\\\|\_\{2\}\(the Euclidean norm is positively homogeneous, so its right\-hand directional derivative at the origin is‖v‖2\\\|v\\\|\_\{2\}\)\. LettingK∗=\{j:xj=x∗\}K\_\{\*\}=\\\{j:x\_\{j\}=x\_\{\*\}\\\}, the total directional derivative decomposes as

D​F​\(x∗;v\)=∑j∉K∗⟨x∗−xj,v⟩‖x∗−xj‖2\+\|K∗\|​‖v‖2\.DF\(x\_\{\*\};v\)\\;=\\;\\sum\_\{j\\notin K\_\{\*\}\}\\frac\{\\langle x\_\{\*\}\-x\_\{j\},v\\rangle\}\{\\\|x\_\{\*\}\-x\_\{j\}\\\|\_\{2\}\}\\;\+\\;\|K\_\{\*\}\|\\,\\\|v\\\|\_\{2\}\.Substitutingv=z−x∗v=z\-x\_\{\*\}and dividing by‖v‖2=Δ\>0\\\|v\\\|\_\{2\}=\\Delta\>0:

D​F​\(x∗;z−x∗\)Δ=−∑j∉K∗cos⁡γj\+\|K∗\|,\\frac\{DF\(x\_\{\*\};z\-x\_\{\*\}\)\}\{\\Delta\}\\;=\\;\-\\sum\_\{j\\notin K\_\{\*\}\}\\cos\\gamma\_\{j\}\\;\+\\;\|K\_\{\*\}\|,\(28\)whereγj\\gamma\_\{j\}is the angle atx∗x\_\{\*\}between the raysx∗→xjx\_\{\*\}\\to x\_\{j\}andx∗→zx\_\{\*\}\\to z, defined forj∉K∗j\\notin K\_\{\*\}bycos⁡γj=⟨xj−x∗,z−x∗⟩/\(‖xj−x∗‖2​Δ\)\\cos\\gamma\_\{j\}=\\langle x\_\{j\}\-x\_\{\*\},\\,z\-x\_\{\*\}\\rangle/\(\\\|x\_\{j\}\-x\_\{\*\}\\\|\_\{2\}\\,\\Delta\)\.

Step 2: Lower\-boundcos⁡γj\\cos\\gamma\_\{j\}for points nearzz\.LetJ≜\{j:‖xj−z‖2≤r\}J\\triangleq\\\{j:\\\|x\_\{j\}\-z\\\|\_\{2\}\\leq r\\\}denote the indices of points within distancerrofzz\. By hypothesis,\|J\|≥\(1−α\)​k\|J\|\\geq\(1\-\\alpha\)k\.

Forj∈Jj\\in J, the pointxjx\_\{j\}lies in the closed ballB¯​\(z,r\)\\overline\{B\}\(z,r\)\. The angleγj\\gamma\_\{j\}atx∗x\_\{\*\}between the raysx∗→xjx\_\{\*\}\\to x\_\{j\}andx∗→zx\_\{\*\}\\to zis at most the half\-angle subtended by the ballB¯​\(z,r\)\\overline\{B\}\(z,r\)as seen fromx∗x\_\{\*\}\. Since‖x∗−z‖2=Δ\\\|x\_\{\*\}\-z\\\|\_\{2\}=\\Deltaand the ball has radiusrr, elementary geometry gives

sin⁡γj≤rΔ,cos⁡γj≥1−r2Δ2\.\\sin\\gamma\_\{j\}\\;\\leq\\;\\frac\{r\}\{\\Delta\},\\qquad\\cos\\gamma\_\{j\}\\;\\geq\\;\\sqrt\{1\-\\frac\{r^\{2\}\}\{\\Delta^\{2\}\}\}\.\(29\)By assumptionΔ\>Cα​r\\Delta\>C\_\{\\alpha\}r, sor/Δ<1/Cαr/\\Delta<1/C\_\{\\alpha\}and \([29](https://arxiv.org/html/2606.30931#A1.E29)\) yields

cos⁡γj\>1−1Cα2for all​j∈J\.\\cos\\gamma\_\{j\}\\;\>\\;\\sqrt\{1\-\\frac\{1\}\{C\_\{\\alpha\}^\{2\}\}\}\\quad\\text\{for all \}j\\in J\.\(30\)
Forj∈Jc∖K∗j\\in J^\{c\}\\setminus K\_\{\*\}\(points farther thanrrfromzzthat do not coincide withx∗x\_\{\*\}\), we have only the trivial boundcos⁡γj≥−1\\cos\\gamma\_\{j\}\\geq\-1\.

Step 3: Combine\.A short observation simplifies the algebra: the constantCα=\(1−α\)/1−2​α≥1C\_\{\\alpha\}=\(1\-\\alpha\)/\\sqrt\{1\-2\\alpha\}\\geq 1forα∈\[0,1/2\)\\alpha\\in\[0,1/2\)\(with equality only atα=0\\alpha=0\)\. Combined with the contradiction hypothesisΔ\>Cα​r≥r\\Delta\>C\_\{\\alpha\}r\\geq r, this implies that everyj∈K∗j\\in K\_\{\*\}\(wherexj=x∗x\_\{j\}=x\_\{\*\}, so‖xj−z‖2=Δ\>r\\\|x\_\{j\}\-z\\\|\_\{2\}=\\Delta\>r\) satisfiesj∈Jcj\\in J^\{c\}\. ThereforeK∗⊆JcK\_\{\*\}\\subseteq J^\{c\}, and the partitionJc=\(Jc∖K∗\)∪K∗J^\{c\}=\(J^\{c\}\\setminus K\_\{\*\}\)\\cup K\_\{\*\}gives\|Jc∖K∗\|=\|Jc\|−\|K∗\|\|J^\{c\}\\setminus K\_\{\*\}\|=\|J^\{c\}\|\-\|K\_\{\*\}\|\.

Substituting into \([28](https://arxiv.org/html/2606.30931#A1.E28)\) and using the angular bounds from Step 2:

D​F​\(x∗;z−x∗\)Δ\\displaystyle\\frac\{DF\(x\_\{\*\};z\-x\_\{\*\}\)\}\{\\Delta\}=−∑j∈Jcos⁡γj−∑j∈Jc∖K∗cos⁡γj\+\|K∗\|\\displaystyle\\;=\\;\-\\sum\_\{j\\in J\}\\cos\\gamma\_\{j\}\\;\-\\;\\sum\_\{j\\in J^\{c\}\\setminus K\_\{\*\}\}\\cos\\gamma\_\{j\}\\;\+\\;\|K\_\{\*\}\|<−\|J\|​1−1/Cα2\+\|Jc∖K∗\|\+\|K∗\|\\displaystyle\\;<\\;\-\|J\|\\,\\sqrt\{1\-1/C\_\{\\alpha\}^\{2\}\}\\;\+\\;\|J^\{c\}\\setminus K\_\{\*\}\|\\;\+\\;\|K\_\{\*\}\|=−\|J\|​1−1/Cα2\+\|Jc\|\\displaystyle\\;=\\;\-\|J\|\\,\\sqrt\{1\-1/C\_\{\\alpha\}^\{2\}\}\\;\+\\;\|J^\{c\}\|≤−\(1−α\)​k​1−1/Cα2\+α​k,\\displaystyle\\;\\leq\\;\-\(1\-\\alpha\)k\\,\\sqrt\{1\-1/C\_\{\\alpha\}^\{2\}\}\\;\+\\;\\alpha k,where the final line uses\|J\|≥\(1−α\)​k\|J\|\\geq\(1\-\\alpha\)kand\|Jc\|≤α​k\|J^\{c\}\|\\leq\\alpha k\.

We now show that the choiceCα=\(1−α\)/1−2​αC\_\{\\alpha\}=\(1\-\\alpha\)/\\sqrt\{1\-2\\alpha\}makes this strictly negative\. Compute:

1−1Cα2=1−1−2​α\(1−α\)2=\(1−α\)2−\(1−2​α\)\(1−α\)2=α2\(1−α\)2\.1\-\\frac\{1\}\{C\_\{\\alpha\}^\{2\}\}\\;=\\;1\-\\frac\{1\-2\\alpha\}\{\(1\-\\alpha\)^\{2\}\}\\;=\\;\\frac\{\(1\-\\alpha\)^\{2\}\-\(1\-2\\alpha\)\}\{\(1\-\\alpha\)^\{2\}\}\\;=\\;\\frac\{\\alpha^\{2\}\}\{\(1\-\\alpha\)^\{2\}\}\.Hence1−1/Cα2=α/\(1−α\)\\sqrt\{1\-1/C\_\{\\alpha\}^\{2\}\}=\\alpha/\(1\-\\alpha\), and:

D​F​\(x∗;z−x∗\)Δ<−\(1−α\)​k⋅α1−α\+α​k=−α​k\+α​k=0\.\\frac\{DF\(x\_\{\*\};z\-x\_\{\*\}\)\}\{\\Delta\}\\;<\\;\-\(1\-\\alpha\)k\\cdot\\frac\{\\alpha\}\{1\-\\alpha\}\+\\alpha k\\;=\\;\-\\alpha k\+\\alpha k\\;=\\;0\.
This contradicts \([27](https://arxiv.org/html/2606.30931#A1.E27)\), which requiredD​F​\(x∗;z−x∗\)≥0DF\(x\_\{\*\};z\-x\_\{\*\}\)\\geq 0\. Therefore the assumption‖x∗−z‖2\>Cα​r\\\|x\_\{\*\}\-z\\\|\_\{2\}\>C\_\{\\alpha\}rmust fail, proving \([16](https://arxiv.org/html/2606.30931#S5.E16)\)\. ∎

### A\.6Proof of Lemma[2](https://arxiv.org/html/2606.30931#Thmlemma2)

For convenience, we recall Lemma[2](https://arxiv.org/html/2606.30931#Thmlemma2): under Assumptions[2](https://arxiv.org/html/2606.30931#Thmassumption2)–[5](https://arxiv.org/html/2606.30931#Thmassumption5), for any slackβ∈\(0,1/2−α\)\\beta\\in\(0,1/2\-\\alpha\), with probability at least1−exp⁡\(−N​β2/2\)1\-\\exp\(\-N\\beta^\{2\}/2\), at least\(1−α−β\)​N\(1\-\\alpha\-\\beta\)Nof theNNjudge outputs lie within distanceρ=σ​\(C1​d\+\(1/c\)​log⁡\(2​\(1−α\)/β\)\)\\rho=\\sigma\\big\(C\_\{1\}\\sqrt\{d\}\+\\sqrt\{\(1/c\)\\log\(2\(1\-\\alpha\)/\\beta\)\}\\big\)of𝐲⋆\{\\mathbf\{y\}\}^\{\\star\}, whereC1,c\>0C\_\{1\},c\>0are absolute constants from the sub\-Gaussian\-norm tail bound derived in Step 1 below\.

#### Note on heterogeneous parameters\.

Assumptions[2](https://arxiv.org/html/2606.30931#Thmassumption2)and[4](https://arxiv.org/html/2606.30931#Thmassumption4)are stated per\-judge \(αi\\alpha\_\{i\}andσi\\sigma\_\{i\}\)\. Throughout this proof we readα\\alphaas the global mean contaminationα=\(1/N\)​∑iαi\\alpha=\(1/N\)\\sum\_\{i\}\\alpha\_\{i\}from Assumption[5](https://arxiv.org/html/2606.30931#Thmassumption5)\(which we are entitled to do because Hoeffding in Step 2 only sees∑i𝔼​Wi\\sum\_\{i\}\\mathbb\{E\}W\_\{i\}; per\-judge heterogeneity averages out at this aggregation step\), andσ\\sigmaasσ=maxi⁡σi\\sigma=\\max\_\{i\}\\sigma\_\{i\}\(the worst\-case sub\-Gaussian parameter, used in Step 1 to bound everyiisimultaneously\)\.

The proof is in three stages: \(1\) control the tail of one competent sample’s deviation‖𝐲^i−𝐲⋆‖2\\\|\\hat\{\{\\mathbf\{y\}\}\}\_\{i\}\-\{\\mathbf\{y\}\}^\{\\star\}\\\|\_\{2\}at probabilityppvia a covering\-net argument; \(2\) count, via Hoeffding, how many of theNNjudges fall inside the resulting ball; \(3\) pickppand a Hoeffding slackuuso that the count exceeds\(1−α−β\)​N\(1\-\\alpha\-\\beta\)Nwith the claimed probability\.

###### Proof of Lemma[2](https://arxiv.org/html/2606.30931#Thmlemma2)\.

Step 1: tail bound for the norm of a single competent sample\.For each judgeii, write the noise decomposition𝐲^i=\(1−Zi\)​\(𝐲⋆\+ϵi\)\+Zi​𝜼i\\hat\{\{\\mathbf\{y\}\}\}\_\{i\}=\(1\-Z\_\{i\}\)\(\{\\mathbf\{y\}\}^\{\\star\}\+\\bm\{\{\\epsilon\}\}\_\{i\}\)\+Z\_\{i\}\\,\\bm\{\\eta\}\_\{i\}of Assumption[2](https://arxiv.org/html/2606.30931#Thmassumption2), whereZi∼Bern​\(α\)Z\_\{i\}\\sim\\mathrm\{Bern\}\(\\alpha\)selects competent \(Zi=0Z\_\{i\}=0\) vs\. corrupted \(Zi=1Z\_\{i\}=1\)\. Conditional onZi=0Z\_\{i\}=0, Assumption[4](https://arxiv.org/html/2606.30931#Thmassumption4)states thatϵi∈ℝd\\bm\{\{\\epsilon\}\}\_\{i\}\\in\\mathbb\{R\}^\{d\}isσ\\sigma\-sub\-Gaussian, i\.e\. for every𝝀∈ℝd\\bm\{\\lambda\}\\in\\mathbb\{R\}^\{d\},

𝔼​\[exp⁡\(⟨𝝀,ϵi⟩\)\|Zi=0\]≤exp⁡\(12​σ2​‖𝝀‖22\)\.\\mathbb\{E\}\\\!\\left\[\\exp\\\!\\big\(\\langle\\bm\{\\lambda\},\\bm\{\{\\epsilon\}\}\_\{i\}\\rangle\\big\)\\,\\big\|\\,Z\_\{i\}=0\\right\]\\;\\leq\\;\\exp\\\!\\big\(\\tfrac\{1\}\{2\}\\sigma^\{2\}\\\|\\bm\{\\lambda\}\\\|\_\{2\}^\{2\}\\big\)\.\(31\)We now show, from \([31](https://arxiv.org/html/2606.30931#A1.E31)\) alone,

Pr⁡\[‖ϵi‖2\>σ​\(C1​d\+t\)\|Zi=0\]≤exp⁡\(−c​t2\),∀t\>0,\\Pr\\\!\\big\[\\\|\\bm\{\{\\epsilon\}\}\_\{i\}\\\|\_\{2\}\>\\sigma\(C\_\{1\}\\sqrt\{d\}\+t\)\\,\\big\|\\,Z\_\{i\}=0\\big\]\\;\\leq\\;\\exp\(\-c\\,t^\{2\}\),\\qquad\\forall\\,t\>0,\(32\)for absolute constantsC1,c\>0C\_\{1\},c\>0\.

We prove \([32](https://arxiv.org/html/2606.30931#A1.E32)\) directly from \([31](https://arxiv.org/html/2606.30931#A1.E31)\) via a covering\-net argument over the unit sphere𝕊d−1=\{𝐮∈ℝd:‖𝐮‖2=1\}\\mathbb\{S\}^\{d\-1\}=\\\{\{\\mathbf\{u\}\}\\in\\mathbb\{R\}^\{d\}:\\\|\{\\mathbf\{u\}\}\\\|\_\{2\}=1\\\}\. All conditioning is on\{Zi=0\}\\\{Z\_\{i\}=0\\\}; we drop the conditioning bar in this step for readability\.

*Step 1a: scalar projections are sub\-Gaussian\.*Fix any unit vector𝐮∈𝕊d−1\{\\mathbf\{u\}\}\\in\\mathbb\{S\}^\{d\-1\}\. Setting𝝀=λ​𝐮\\bm\{\\lambda\}=\\lambda\{\\mathbf\{u\}\}in \([31](https://arxiv.org/html/2606.30931#A1.E31)\):

𝔼​\[exp⁡\(λ​⟨𝐮,ϵi⟩\)\]≤exp⁡\(12​σ2​λ2\),∀λ∈ℝ\.\\mathbb\{E\}\\\!\\big\[\\exp\(\\lambda\\,\\langle\{\\mathbf\{u\}\},\\bm\{\{\\epsilon\}\}\_\{i\}\\rangle\)\\big\]\\;\\leq\\;\\exp\\\!\\big\(\\tfrac\{1\}\{2\}\\sigma^\{2\}\\lambda^\{2\}\\big\),\\qquad\\forall\\,\\lambda\\in\\mathbb\{R\}\.\(33\)That is, the scalar variable⟨𝐮,ϵi⟩\\langle\{\\mathbf\{u\}\},\\bm\{\{\\epsilon\}\}\_\{i\}\\rangleisσ\\sigma\-sub\-Gaussian inℝ\\mathbb\{R\}\. By Markov’s inequality applied toexp⁡\(λ​⟨𝐮,ϵi⟩\)\\exp\(\\lambda\\langle\{\\mathbf\{u\}\},\\bm\{\{\\epsilon\}\}\_\{i\}\\rangle\):

Pr⁡\[⟨𝐮,ϵi⟩\>s\]≤exp⁡\(−λ​s\+12​σ2​λ2\),\\Pr\\\!\\big\[\\langle\{\\mathbf\{u\}\},\\bm\{\{\\epsilon\}\}\_\{i\}\\rangle\>s\\big\]\\;\\leq\\;\\exp\(\-\\lambda s\+\\tfrac\{1\}\{2\}\\sigma^\{2\}\\lambda^\{2\}\),\(34\)and minimizing the right\-hand side overλ\>0\\lambda\>0atλ=s/σ2\\lambda=s/\\sigma^\{2\}gives the sharp scalar Hoeffding\-style bound

Pr⁡\[⟨𝐮,ϵi⟩\>s\]≤exp⁡\(−s2/\(2​σ2\)\),∀s\>0\.\\Pr\\\!\\big\[\\langle\{\\mathbf\{u\}\},\\bm\{\{\\epsilon\}\}\_\{i\}\\rangle\>s\\big\]\\;\\leq\\;\\exp\\\!\\big\(\-s^\{2\}/\(2\\sigma^\{2\}\)\\big\),\\qquad\\forall\\,s\>0\.\(35\)
*Step 1b: discretize the sphere with a1/21/2\-net\.*Let𝒩⊂𝕊d−1\{\\mathcal\{N\}\}\\subset\\mathbb\{S\}^\{d\-1\}be a1/21/2\-net of the sphere in Euclidean distance: every𝐮∈𝕊d−1\{\\mathbf\{u\}\}\\in\\mathbb\{S\}^\{d\-1\}is within distance1/21/2of some𝐮′∈𝒩\{\\mathbf\{u\}\}^\{\\prime\}\\in\{\\mathcal\{N\}\}\. Such a net exists with cardinality

\|𝒩\|≤5d\|\{\\mathcal\{N\}\}\|\\;\\leq\\;5^\{d\}\(36\)by a volumetric covering argument \(Vershynin,[2018](https://arxiv.org/html/2606.30931#bib.bib21), Cor\. 4\.2\.13: the unit sphere admits anϵ\{\\epsilon\}\-net of size\(1\+2/ϵ\)d\(1\+2/\{\\epsilon\}\)^\{d\}; takeϵ=1/2\{\\epsilon\}=1/2\)\.

*Step 1c: net\-supremum approximates the true supremum\.*By definition,‖ϵi‖2=sup𝐮∈𝕊d−1⟨𝐮,ϵi⟩\\\|\\bm\{\{\\epsilon\}\}\_\{i\}\\\|\_\{2\}=\\sup\_\{\{\\mathbf\{u\}\}\\in\\mathbb\{S\}^\{d\-1\}\}\\langle\{\\mathbf\{u\}\},\\bm\{\{\\epsilon\}\}\_\{i\}\\rangle\. Pick the maximizer𝐮∗\{\\mathbf\{u\}\}^\{\*\}and let𝐮′∈𝒩\{\\mathbf\{u\}\}^\{\\prime\}\\in\{\\mathcal\{N\}\}satisfy‖𝐮∗−𝐮′‖2≤1/2\\\|\{\\mathbf\{u\}\}^\{\*\}\-\{\\mathbf\{u\}\}^\{\\prime\}\\\|\_\{2\}\\leq 1/2\. Then

⟨𝐮∗,ϵi⟩\\displaystyle\\langle\{\\mathbf\{u\}\}^\{\*\},\\bm\{\{\\epsilon\}\}\_\{i\}\\rangle=⟨𝐮′,ϵi⟩\+⟨𝐮∗−𝐮′,ϵi⟩\\displaystyle\\;=\\;\\langle\{\\mathbf\{u\}\}^\{\\prime\},\\bm\{\{\\epsilon\}\}\_\{i\}\\rangle\\;\+\\;\\langle\{\\mathbf\{u\}\}^\{\*\}\-\{\\mathbf\{u\}\}^\{\\prime\},\\bm\{\{\\epsilon\}\}\_\{i\}\\rangle≤max𝐮∈𝒩⁡⟨𝐮,ϵi⟩\+12​‖ϵi‖2\\displaystyle\\;\\leq\\;\\max\_\{\{\\mathbf\{u\}\}\\in\{\\mathcal\{N\}\}\}\\langle\{\\mathbf\{u\}\},\\bm\{\{\\epsilon\}\}\_\{i\}\\rangle\\;\+\\;\\tfrac\{1\}\{2\}\\,\\\|\\bm\{\{\\epsilon\}\}\_\{i\}\\\|\_\{2\}where the second line uses Cauchy–Schwarz and‖𝐮∗−𝐮′‖2≤1/2\\\|\{\\mathbf\{u\}\}^\{\*\}\-\{\\mathbf\{u\}\}^\{\\prime\}\\\|\_\{2\}\\leq 1/2\. Since the left\-hand side equals‖ϵi‖2\\\|\\bm\{\{\\epsilon\}\}\_\{i\}\\\|\_\{2\}, rearranging gives

‖ϵi‖2≤2​max𝐮∈𝒩⁡⟨𝐮,ϵi⟩\.\\\|\\bm\{\{\\epsilon\}\}\_\{i\}\\\|\_\{2\}\\;\\leq\\;2\\,\\max\_\{\{\\mathbf\{u\}\}\\in\{\\mathcal\{N\}\}\}\\langle\{\\mathbf\{u\}\},\\bm\{\{\\epsilon\}\}\_\{i\}\\rangle\.\(37\)
*Step 1d: union bound over the net\.*Combining \([37](https://arxiv.org/html/2606.30931#A1.E37)\), \([35](https://arxiv.org/html/2606.30931#A1.E35)\), and \([36](https://arxiv.org/html/2606.30931#A1.E36)\): for anyr\>0r\>0,

Pr⁡\[‖ϵi‖2\>2​r\]\\displaystyle\\Pr\\\!\\big\[\\\|\\bm\{\{\\epsilon\}\}\_\{i\}\\\|\_\{2\}\>2r\\big\]≤Pr⁡\[max𝐮∈𝒩⁡⟨𝐮,ϵi⟩\>r\]\\displaystyle\\;\\leq\\;\\Pr\\\!\\Big\[\\max\_\{\{\\mathbf\{u\}\}\\in\{\\mathcal\{N\}\}\}\\langle\{\\mathbf\{u\}\},\\bm\{\{\\epsilon\}\}\_\{i\}\\rangle\>r\\Big\]≤\|𝒩\|​exp⁡\(−r2/\(2​σ2\)\)\\displaystyle\\;\\leq\\;\|\{\\mathcal\{N\}\}\|\\,\\exp\\\!\\big\(\-r^\{2\}/\(2\\sigma^\{2\}\)\\big\)≤exp⁡\(d​log⁡5−r2/\(2​σ2\)\)\.\\displaystyle\\;\\leq\\;\\exp\\\!\\big\(d\\log 5\-r^\{2\}/\(2\\sigma^\{2\}\)\\big\)\.Substitutingr=σ​2​\(d​log⁡5\+s\)r=\\sigma\\sqrt\{2\(d\\log 5\+s\)\}fors\>0s\>0:

Pr⁡\[‖ϵi‖2\>2​σ​2​\(d​log⁡5\+s\)\]≤exp⁡\(−s\)\.\\Pr\\\!\\Big\[\\\|\\bm\{\{\\epsilon\}\}\_\{i\}\\\|\_\{2\}\>2\\sigma\\sqrt\{2\(d\\log 5\+s\)\}\\Big\]\\;\\leq\\;\\exp\(\-s\)\.Usinga\+b≤a\+b\\sqrt\{a\+b\}\\leq\\sqrt\{a\}\+\\sqrt\{b\}fora,b≥0a,b\\geq 0:

2​σ​2​\(d​log⁡5\+s\)≤2​σ​2​d​log⁡5\+2​σ​2​s=C1​σ​d\+C2​σ​s,2\\sigma\\sqrt\{2\(d\\log 5\+s\)\}\\;\\leq\\;2\\sigma\\sqrt\{2d\\log 5\}\+2\\sigma\\sqrt\{2s\}\\;=\\;C\_\{1\}\\sigma\\sqrt\{d\}\+C\_\{2\}\\sigma\\sqrt\{s\},withC1=2​2​log⁡5≤4C\_\{1\}=2\\sqrt\{2\\log 5\}\\leq 4andC2=2​2C\_\{2\}=2\\sqrt\{2\}\. Substitutings=c​t2s=c\\,t^\{2\}withc=1/C22=1/8c=1/C\_\{2\}^\{2\}=1/8:C2​σ​s=C2​σ​c​t2=C2​σ​t/C2=σ​tC\_\{2\}\\sigma\\sqrt\{s\}=C\_\{2\}\\sigma\\sqrt\{ct^\{2\}\}=C\_\{2\}\\sigma\\,t/C\_\{2\}=\\sigma\\,t\. Hence for allt≥0t\\geq 0,

Pr⁡\[‖ϵi‖2\>C1​σ​d\+σ​t\]≤exp⁡\(−c​t2\),\\Pr\\\!\\big\[\\\|\\bm\{\{\\epsilon\}\}\_\{i\}\\\|\_\{2\}\>C\_\{1\}\\sigma\\sqrt\{d\}\+\\sigma t\\big\]\\;\\leq\\;\\exp\(\-c\\,t^\{2\}\),\(38\)which is exactly \([32](https://arxiv.org/html/2606.30931#A1.E32)\) with the same absolute constantsC1=2​2​log⁡5≤4C\_\{1\}=2\\sqrt\{2\\log 5\}\\leq 4andc=1/8c=1/8\.

*Remark on the explicit constants\.*The covering radius1/21/2, net size5d5^\{d\}, and resulting prefactorC1=2​2​log⁡5C\_\{1\}=2\\sqrt\{2\\log 5\}are not optimized; sharper chaining bounds \(Boucheronet al\.,[2013](https://arxiv.org/html/2606.30931#bib.bib42), §5\.4\) reduceC1C\_\{1\}towards11at the cost of a more involved proof\. For our purposes the orderσ​\(d\+t\)\\sigma\(\\sqrt\{d\}\+t\)is what matters, so we proceed with the simpler bound\.

*Step 1c: solve for the radius at tail probabilitypp\.*Sett=\(1/c\)​log⁡\(1/p\)t=\\sqrt\{\(1/c\)\\log\(1/p\)\}in \([32](https://arxiv.org/html/2606.30931#A1.E32)\); the right\-hand side becomesexp⁡\(−c⋅\(1/c\)​log⁡\(1/p\)\)=exp⁡\(log⁡p\)=p\\exp\(\-c\\cdot\(1/c\)\\log\(1/p\)\)=\\exp\(\\log p\)=p\. Defining

ρp≜σ​\(C1​d\+\(1/c\)​log⁡\(1/p\)\),\\rho\_\{p\}\\;\\triangleq\\;\\sigma\\\!\\left\(C\_\{1\}\\sqrt\{d\}\+\\sqrt\{\(1/c\)\\log\(1/p\)\}\\right\),\(39\)we obtain the per\-sample tail bound

Pr⁡\[‖ϵi‖2\>ρp\|Zi=0\]≤p\.\\Pr\\\!\\big\[\\\|\\bm\{\{\\epsilon\}\}\_\{i\}\\\|\_\{2\}\>\\rho\_\{p\}\\,\\big\|\\,Z\_\{i\}=0\\big\]\\;\\leq\\;p\.\(40\)
Step 2: count of judges withinρp\\rho\_\{p\}of𝐲⋆\{\\mathbf\{y\}\}^\{\\star\}\.For eachi∈\[N\]i\\in\[N\]define the indicator

Wi≜1​\{Zi=0​and‖ϵi∥2≤ρp\}\.W\_\{i\}\\;\\triangleq\\;\\mathbb\{1\}\\\!\\left\\\{Z\_\{i\}=0\\;\\text\{and\}\\;\\\|\\bm\{\{\\epsilon\}\}\_\{i\}\\\|\_\{2\}\\leq\\rho\_\{p\}\\right\\\}\.\(41\)On\{Wi=1\}\\\{W\_\{i\}=1\\\}judgeiiis competent and within distanceρp\\rho\_\{p\}of𝐲⋆\{\\mathbf\{y\}\}^\{\\star\}\(since𝐲^i−𝐲⋆=ϵi\\hat\{\{\\mathbf\{y\}\}\}\_\{i\}\-\{\\mathbf\{y\}\}^\{\\star\}=\\bm\{\{\\epsilon\}\}\_\{i\}whenZi=0Z\_\{i\}=0\); hence

∑i=1NWi≤\|\{i∈\[N\]:‖𝐲^i−𝐲⋆‖2≤ρp\}\|\.\\sum\_\{i=1\}^\{N\}W\_\{i\}\\;\\leq\\;\\big\|\\big\\\{i\\in\[N\]:\\\|\\hat\{\{\\mathbf\{y\}\}\}\_\{i\}\-\{\\mathbf\{y\}\}^\{\\star\}\\\|\_\{2\}\\leq\\rho\_\{p\}\\big\\\}\\big\|\.\(42\)The right\-hand count is the cluster size we want to lower\-bound, so it suffices to lower\-bound∑Wi\\sum W\_\{i\}\.

*Step 2a: marginal mean ofWiW\_\{i\}\.*By the tower rule,𝔼​Wi=Pr⁡\[Zi=0\]​Pr⁡\[‖ϵi‖2≤ρp∣Zi=0\]\\mathbb\{E\}W\_\{i\}=\\Pr\[Z\_\{i\}=0\]\\,\\Pr\[\\\|\\bm\{\{\\epsilon\}\}\_\{i\}\\\|\_\{2\}\\leq\\rho\_\{p\}\\mid Z\_\{i\}=0\]\. UsingPr⁡\[Zi=0\]=1−α\\Pr\[Z\_\{i\}=0\]=1\-\\alphafrom Assumption[2](https://arxiv.org/html/2606.30931#Thmassumption2)and \([40](https://arxiv.org/html/2606.30931#A1.E40)\),

𝔼​Wi≥\(1−α\)​\(1−p\)\.\\mathbb\{E\}W\_\{i\}\\;\\geq\\;\(1\-\\alpha\)\(1\-p\)\.\(43\)
*Step 2b: independence ofWiW\_\{i\}acrossii\.*EachWiW\_\{i\}is a measurable function of\(Zi,ϵi\)\(Z\_\{i\},\\bm\{\{\\epsilon\}\}\_\{i\}\)\(forZi=1Z\_\{i\}=1, the value of𝜼i\\bm\{\\eta\}\_\{i\}does not enterWiW\_\{i\}because the indicator forcesZi=0Z\_\{i\}=0\)\. By Assumption[3](https://arxiv.org/html/2606.30931#Thmassumption3)the tuples\{\(Zi,ϵi,𝜼i\)\}i=1N\\\{\(Z\_\{i\},\\bm\{\{\\epsilon\}\}\_\{i\},\\bm\{\\eta\}\_\{i\}\)\\\}\_\{i=1\}^\{N\}are mutually independent, hence so are theWiW\_\{i\}\.

*Step 2c: Hoeffding’s inequality\.*EachWi∈\{0,1\}⊆\[0,1\]W\_\{i\}\\in\\\{0,1\\\}\\subseteq\[0,1\]\. Hoeffding’s inequality\(Boucheronet al\.,[2013](https://arxiv.org/html/2606.30931#bib.bib42), Theorem 2\.8\)applied to the independent bounded variablesWiW\_\{i\}states: for anyu\>0u\>0,

Pr⁡\[1N​∑i=1NWi−1N​∑i=1N𝔼​Wi<−u\]≤exp⁡\(−2​N​u2\)\.\\Pr\\\!\\left\[\\frac\{1\}\{N\}\\sum\_\{i=1\}^\{N\}W\_\{i\}\-\\frac\{1\}\{N\}\\sum\_\{i=1\}^\{N\}\\mathbb\{E\}W\_\{i\}<\-u\\right\]\\;\\leq\\;\\exp\(\-2Nu^\{2\}\)\.\(44\)Combining \([44](https://arxiv.org/html/2606.30931#A1.E44)\) with the lower bound \([43](https://arxiv.org/html/2606.30931#A1.E43)\) on each𝔼​Wi\\mathbb\{E\}W\_\{i\}:

Pr⁡\[∑i=1NWi<\(1−α\)​\(1−p\)​N−u​N\]≤exp⁡\(−2​N​u2\)\.\\Pr\\\!\\left\[\\sum\_\{i=1\}^\{N\}W\_\{i\}<\(1\-\\alpha\)\(1\-p\)N\-uN\\right\]\\;\\leq\\;\\exp\(\-2Nu^\{2\}\)\.\(45\)
Step 3: chooseppanduuto expose slackβ\\beta\.We want the lower\-bound count\(1−α\)​\(1−p\)​N−u​N\(1\-\\alpha\)\(1\-p\)N\-uNto be at least\(1−α−β\)​N\(1\-\\alpha\-\\beta\)N:

\(1−α\)​\(1−p\)−u≥1−α−β⇔\(1−α\)​p\+u≤β\.\(1\-\\alpha\)\(1\-p\)\-u\\;\\geq\\;1\-\\alpha\-\\beta\\quad\\iff\\quad\(1\-\\alpha\)\\,p\+u\\;\\leq\\;\\beta\.Split the slackβ\\betaequally between the per\-sample tail and the Hoeffding deviation by choosing

p=β2​\(1−α\),u=β2\.p\\;=\\;\\frac\{\\beta\}\{2\(1\-\\alpha\)\},\\qquad u\\;=\\;\\frac\{\\beta\}\{2\}\.\(46\)Then\(1−α\)​p=β/2\(1\-\\alpha\)p=\\beta/2, so\(1−α\)​p\+u=β\(1\-\\alpha\)p\+u=\\betaexactly, verifying the constraint\. Substitutingu=β/2u=\\beta/2into \([45](https://arxiv.org/html/2606.30931#A1.E45)\):

Pr⁡\[∑i=1NWi<\(1−α−β\)​N\]≤exp⁡\(−2​N​\(β/2\)2\)=exp⁡\(−N​β2/2\)\.\\Pr\\\!\\left\[\\sum\_\{i=1\}^\{N\}W\_\{i\}<\(1\-\\alpha\-\\beta\)N\\right\]\\;\\leq\\;\\exp\\\!\\big\(\-2N\(\\beta/2\)^\{2\}\\big\)\\;=\\;\\exp\(\-N\\beta^\{2\}/2\)\.\(47\)Substitutingp=β/\(2​\(1−α\)\)p=\\beta/\(2\(1\-\\alpha\)\)into \([39](https://arxiv.org/html/2606.30931#A1.E39)\), the radius becomes

ρ≜ρp\|p=β/\(2​\(1−α\)\)=σ​\(C1​d\+1c​log⁡2​\(1−α\)β\),\\rho\\;\\triangleq\\;\\rho\_\{p\}\\big\|\_\{p=\\beta/\(2\(1\-\\alpha\)\)\}\\;=\\;\\sigma\\\!\\left\(C\_\{1\}\\sqrt\{d\}\+\\sqrt\{\\tfrac\{1\}\{c\}\\log\\\!\\tfrac\{2\(1\-\\alpha\)\}\{\\beta\}\}\\right\),which is exactly \([18](https://arxiv.org/html/2606.30931#S5.E18)\)\.

Step 4: assemble the conclusion\.On the complementary event of \([47](https://arxiv.org/html/2606.30931#A1.E47)\), which has probability at least1−exp⁡\(−N​β2/2\)1\-\\exp\(\-N\\beta^\{2\}/2\), the bound∑Wi≥\(1−α−β\)​N\\sum W\_\{i\}\\geq\(1\-\\alpha\-\\beta\)Nholds\. Combined with \([42](https://arxiv.org/html/2606.30931#A1.E42)\):

\|\{i∈\[N\]:‖𝐲^i−𝐲⋆‖2≤ρ\}\|≥∑i=1NWi≥\(1−α−β\)​N\\big\|\\big\\\{i\\in\[N\]:\\\|\\hat\{\{\\mathbf\{y\}\}\}\_\{i\}\-\{\\mathbf\{y\}\}^\{\\star\}\\\|\_\{2\}\\leq\\rho\\big\\\}\\big\|\\;\\geq\\;\\sum\_\{i=1\}^\{N\}W\_\{i\}\\;\\geq\\;\(1\-\\alpha\-\\beta\)Non the same event\. This is \([17](https://arxiv.org/html/2606.30931#S5.E17)\)\. ∎

#### On the choice of competent\-component assumption\.

The sub\-Gaussian assumption is one of four natural choices for the competent component, ordered from weakest to strongest\. Each gives a different cluster\-radius bound; sub\-Gaussian is the choice that delivers Lemma[2](https://arxiv.org/html/2606.30931#Thmlemma2)\. We record the alternatives for context\.

### A\.7Proof of Theorem[1](https://arxiv.org/html/2606.30931#Thmtheorem1)

For convenience, we recall Theorem[1](https://arxiv.org/html/2606.30931#Thmtheorem1): under Assumptions[2](https://arxiv.org/html/2606.30931#Thmassumption2)–[5](https://arxiv.org/html/2606.30931#Thmassumption5), fix any slackβ∈\(0,1/2−α\)\\beta\\in\(0,1/2\-\\alpha\); with probability at least1−exp⁡\(−N​β2/2\)1\-\\exp\(\-N\\beta^\{2\}/2\),‖𝐲^GM−𝐲⋆‖2≤Cα\+β​ρ\\\|\\hat\{\{\\mathbf\{y\}\}\}\_\{\\mathrm\{GM\}\}\-\{\\mathbf\{y\}\}^\{\\star\}\\\|\_\{2\}\\leq C\_\{\\alpha\+\\beta\}\\,\\rho, where𝐲^GM\\hat\{\{\\mathbf\{y\}\}\}\_\{\\mathrm\{GM\}\}is any geometric median of theNNjudge outputs \(Definition[7](https://arxiv.org/html/2606.30931#Thmdefinition7)\),Cα\+β=\(1−α−β\)/1−2​\(α\+β\)C\_\{\\alpha\+\\beta\}=\(1\-\\alpha\-\\beta\)/\\sqrt\{1\-2\(\\alpha\+\\beta\)\}is the geometric\-breakdown constant of Lemma[1](https://arxiv.org/html/2606.30931#Thmlemma1)evaluated atα\+β\\alpha\+\\beta, andρ=σ​\(C1​d\+\(1/c\)​log⁡\(2​\(1−α\)/β\)\)\\rho=\\sigma\(C\_\{1\}\\sqrt\{d\}\+\\sqrt\{\(1/c\)\\log\(2\(1\-\\alpha\)/\\beta\)\}\)is the cluster radius of Lemma[2](https://arxiv.org/html/2606.30931#Thmlemma2)\(C1,c\>0C\_\{1\},c\>0absolute constants\)\.

###### Proof of Theorem[1](https://arxiv.org/html/2606.30931#Thmtheorem1)\.

The proof is a clean composition of the deterministic geometric bound \(Lemma[1](https://arxiv.org/html/2606.30931#Thmlemma1)\) and the probabilistic cluster\-radius bound \(Lemma[2](https://arxiv.org/html/2606.30931#Thmlemma2)\)\. We make the composition fully explicit\.

Step 1: define the cluster event\.Letβ∈\(0,1/2−α\)\\beta\\in\(0,1/2\-\\alpha\)be the slack from the theorem statement\. Letρ=σ​\(C1​d\+\(1/c\)​log⁡\(2​\(1−α\)/β\)\)\\rho=\\sigma\(C\_\{1\}\\sqrt\{d\}\+\\sqrt\{\(1/c\)\\log\(2\(1\-\\alpha\)/\\beta\)\}\)be the cluster radius from \([18](https://arxiv.org/html/2606.30931#S5.E18)\), and define the event

ℰ≜\{\|J\|≥\(1−α−β\)​N\},J≜\{i∈\[N\]:‖𝐲^i−𝐲⋆‖2≤ρ\}\.\{\\mathcal\{E\}\}\\;\\triangleq\\;\\big\\\{\\,\|J\|\\;\\geq\\;\(1\-\\alpha\-\\beta\)N\\,\\big\\\},\\qquad J\\;\\triangleq\\;\\big\\\{i\\in\[N\]:\\\|\\hat\{\{\\mathbf\{y\}\}\}\_\{i\}\-\{\\mathbf\{y\}\}^\{\\star\}\\\|\_\{2\}\\leq\\rho\\big\\\}\.\(48\)By Lemma[2](https://arxiv.org/html/2606.30931#Thmlemma2)applied with this slackβ\\beta,

Pr⁡\[ℰ\]≥1−exp⁡\(−N​β2/2\)\.\\Pr\[\{\\mathcal\{E\}\}\]\\;\\geq\\;1\-\\exp\(\-N\\beta^\{2\}/2\)\.\(49\)The remainder of the proof works onℰ\{\\mathcal\{E\}\}\(sample\-pathwise\); no further probability is incurred\.

Step 2: verify the hypothesis of Lemma[1](https://arxiv.org/html/2606.30931#Thmlemma1)\.Onℰ\{\\mathcal\{E\}\}, we apply Lemma[1](https://arxiv.org/html/2606.30931#Thmlemma1)with the substitutions

k←N,z←𝐲⋆,r←ρ,α←α\+β\.k\\leftarrow N,\\qquad z\\leftarrow\{\\mathbf\{y\}\}^\{\\star\},\\qquad r\\leftarrow\\rho,\\qquad\\alpha\\leftarrow\\alpha\+\\beta\.\(50\)The hypothesis of Lemma[1](https://arxiv.org/html/2606.30931#Thmlemma1)\(in its statement form: “at least\(1−α\)​k\(1\-\\alpha\)\\,kof thekkpoints lie within distancerrofzz”\) becomes, under these substitutions,

\|J\|≥\(1−\(α\+β\)\)​N=\(1−α−β\)​N,\|J\|\\;\\geq\\;\\big\(1\-\(\\alpha\+\\beta\)\\big\)N\\;=\\;\(1\-\\alpha\-\\beta\)N,which is exactly the definition ofℰ\{\\mathcal\{E\}\}\. The range conditionα\+β∈\(0,1/2\)\\alpha\+\\beta\\in\(0,1/2\)holds sinceα\>0\\alpha\>0\(by Assumption[2](https://arxiv.org/html/2606.30931#Thmassumption2)’sαi≥0\\alpha\_\{i\}\\geq 0andβ\>0\\beta\>0\) andα\+β<1/2\\alpha\+\\beta<1/2\(byβ<1/2−α\\beta<1/2\-\\alpha\)\.

Step 3: apply Lemma[1](https://arxiv.org/html/2606.30931#Thmlemma1)and read off the bound\.The conclusion of Lemma[1](https://arxiv.org/html/2606.30931#Thmlemma1)under the substitutions \([50](https://arxiv.org/html/2606.30931#A1.E50)\) is

‖x∗−z‖2≤Cα\+β​ri\.e\.‖𝐲^GM−𝐲⋆‖2≤Cα\+β​ρ,\\\|x\_\{\*\}\-z\\\|\_\{2\}\\;\\leq\\;C\_\{\\alpha\+\\beta\}\\,r\\quad\\text\{i\.e\.\}\\quad\\\|\\hat\{\{\\mathbf\{y\}\}\}\_\{\\mathrm\{GM\}\}\-\{\\mathbf\{y\}\}^\{\\star\}\\\|\_\{2\}\\;\\leq\\;C\_\{\\alpha\+\\beta\}\\,\\rho,whereCα\+β=\(1−α−β\)/1−2​\(α\+β\)C\_\{\\alpha\+\\beta\}=\(1\-\\alpha\-\\beta\)/\\sqrt\{1\-2\(\\alpha\+\\beta\)\}andx∗=𝐲^GMx\_\{\*\}=\\hat\{\{\\mathbf\{y\}\}\}\_\{\\mathrm\{GM\}\}is any minimizer ofz↦∑i=1N‖z−𝐲^i‖2z\\mapsto\\sum\_\{i=1\}^\{N\}\\\|z\-\\hat\{\{\\mathbf\{y\}\}\}\_\{i\}\\\|\_\{2\}\(the geometric median\)\. Lemma[1](https://arxiv.org/html/2606.30931#Thmlemma1)as proved in §[A\.5](https://arxiv.org/html/2606.30931#A1.SS5)applies to*any*minimizer, so the conclusion is independent of any choice in the \(collinear\) case where the GM is non\-unique\.

Step 4: assemble\.Combining \([49](https://arxiv.org/html/2606.30931#A1.E49)\) with the deterministic bound onℰ\{\\mathcal\{E\}\}from Step 3:

Pr⁡\[‖𝐲^GM−𝐲⋆‖2≤1−α−β1−2​\(α\+β\)⏟Cα\+β⋅σ​\(C1​d\+1c​log⁡2​\(1−α\)β\)⏟ρ\]≥1−exp⁡\(−N​β2/2\),\\Pr\\\!\\Big\[\\,\\\|\\hat\{\{\\mathbf\{y\}\}\}\_\{\\mathrm\{GM\}\}\-\{\\mathbf\{y\}\}^\{\\star\}\\\|\_\{2\}\\;\\leq\\;\\underbrace\{\\frac\{1\-\\alpha\-\\beta\}\{\\sqrt\{1\-2\(\\alpha\+\\beta\)\}\}\}\_\{C\_\{\\alpha\+\\beta\}\}\\cdot\\underbrace\{\\sigma\\\!\\left\(C\_\{1\}\\sqrt\{d\}\+\\sqrt\{\\tfrac\{1\}\{c\}\\log\\tfrac\{2\(1\-\\alpha\)\}\{\\beta\}\}\\right\)\}\_\{\\rho\}\\,\\Big\]\\;\\geq\\;1\-\\exp\(\-N\\beta^\{2\}/2\),which is exactly \([19](https://arxiv.org/html/2606.30931#S5.E19)\)\. ∎

### A\.8Proof of Lemma[3](https://arxiv.org/html/2606.30931#Thmlemma3)

For convenience we recall Lemma[3](https://arxiv.org/html/2606.30931#Thmlemma3): under Assumptions[2](https://arxiv.org/html/2606.30931#Thmassumption2),[4](https://arxiv.org/html/2606.30931#Thmassumption4),[5](https://arxiv.org/html/2606.30931#Thmassumption5)and the equicorrelated\-indicator assumption \(replacing Asm\.[3](https://arxiv.org/html/2606.30931#Thmassumption3)\)Cov​\(Wi,Wj\)≤γ¯W​Var​\(Wi\)​Var​\(Wj\)\\mathrm\{Cov\}\(W\_\{i\},W\_\{j\}\)\\leq\\bar\{\\gamma\}\_\{W\}\\sqrt\{\\mathrm\{Var\}\(W\_\{i\}\)\\mathrm\{Var\}\(W\_\{j\}\)\}fori≠ji\\neq j, withγ¯W∈\[0,1\]\\bar\{\\gamma\}\_\{W\}\\in\[0,1\], theRoPoLLbound‖𝐲^GM−𝐲⋆‖2≤Cα\+β​ρ\\\|\\hat\{\{\\mathbf\{y\}\}\}\_\{\\mathrm\{GM\}\}\-\{\\mathbf\{y\}\}^\{\\star\}\\\|\_\{2\}\\leq C\_\{\\alpha\+\\beta\}\\rhoholds with probability at least1−1/\(β2​Neff\)1\-1/\(\\beta^\{2\}N\_\{\\mathrm\{eff\}\}\), whereNeff=N/\(1\+\(N−1\)​γ¯W\)N\_\{\\mathrm\{eff\}\}=N/\(1\+\(N\-1\)\\bar\{\\gamma\}\_\{W\}\)\.

The proof follows the same skeleton as Lemma[2](https://arxiv.org/html/2606.30931#Thmlemma2)\(per\-sample tail→\\tocount\-bound\) combined with Lemma[1](https://arxiv.org/html/2606.30931#Thmlemma1)\(deterministic geometric step\), but replaces the Hoeffding count\-bound \(which required independence\) with a Chebyshev count\-bound on the variance of∑iWi\\sum\_\{i\}W\_\{i\}under the bounded\-covariance hypothesis\. The deterministic geometric step \(Lemma[1](https://arxiv.org/html/2606.30931#Thmlemma1)\) and the per\-sample sub\-Gaussian tail \(Step 1 of Lemma[2](https://arxiv.org/html/2606.30931#Thmlemma2)’s proof\) are correlation\-free and carry through unchanged\.

###### Proof of Lemma[3](https://arxiv.org/html/2606.30931#Thmlemma3)\.

Step 1: marginal mean of each indicator\.The indicatorWi=𝟏​\{Zi=0,‖𝐲^i−𝐲⋆‖2≤ρp\}W\_\{i\}=\\mathbf\{1\}\\\{Z\_\{i\}=0,\\ \\\|\\hat\{\{\\mathbf\{y\}\}\}\_\{i\}\-\{\\mathbf\{y\}\}^\{\\star\}\\\|\_\{2\}\\leq\\rho\_\{p\}\\\}factors asWi=𝟏​\{Zi=0\}⋅𝟏​\{‖ϵi‖2≤ρp\}W\_\{i\}=\\mathbf\{1\}\\\{Z\_\{i\}=0\\\}\\cdot\\mathbf\{1\}\\\{\\\|\\bm\{\{\\epsilon\}\}\_\{i\}\\\|\_\{2\}\\leq\\rho\_\{p\}\\\}\(whenZi=0Z\_\{i\}=0we have𝐲^i−𝐲⋆=ϵi\\hat\{\{\\mathbf\{y\}\}\}\_\{i\}\-\{\\mathbf\{y\}\}^\{\\star\}=\\bm\{\{\\epsilon\}\}\_\{i\}; whenZi=1Z\_\{i\}=1the first indicator forcesWi=0W\_\{i\}=0regardless of𝜼i\\bm\{\\eta\}\_\{i\}, so𝜼i\\bm\{\\eta\}\_\{i\}does not enterWiW\_\{i\}\)\. By the tower rule,

𝔼​Wi\\displaystyle\\mathbb\{E\}W\_\{i\}=Pr⁡\[Zi=0\]⋅Pr⁡\[‖ϵi‖2≤ρp∣Zi=0\]\\displaystyle=\\Pr\[Z\_\{i\}=0\]\\cdot\\Pr\[\\\|\\bm\{\{\\epsilon\}\}\_\{i\}\\\|\_\{2\}\\leq\\rho\_\{p\}\\mid Z\_\{i\}=0\]≥\(1−αi\)​\(1−p\),\\displaystyle\\geq\(1\-\\alpha\_\{i\}\)\(1\-p\),usingPr⁡\[Zi=0\]=1−αi\\Pr\[Z\_\{i\}=0\]=1\-\\alpha\_\{i\}from Assumption[2](https://arxiv.org/html/2606.30931#Thmassumption2)and the per\-sample tailPr⁡\[‖ϵi‖2≤ρp∣Zi=0\]≥1−p\\Pr\[\\\|\\bm\{\{\\epsilon\}\}\_\{i\}\\\|\_\{2\}\\leq\\rho\_\{p\}\\mid Z\_\{i\}=0\]\\geq 1\-pfrom Step 1 of Lemma[2](https://arxiv.org/html/2606.30931#Thmlemma2)’s proof \(which is correlation\-free\)\. Summing overiiand usingα=N−1​∑iαi\\alpha=N^\{\-1\}\\sum\_\{i\}\\alpha\_\{i\}\(Assumption[5](https://arxiv.org/html/2606.30931#Thmassumption5)\):

μN≜∑i=1N𝔼​Wi≥∑i=1N\(1−αi\)​\(1−p\)=N​\(1−α\)​\(1−p\)\.\\mu\_\{N\}\\;\\triangleq\\;\\sum\_\{i=1\}^\{N\}\\mathbb\{E\}W\_\{i\}\\;\\geq\\;\\sum\_\{i=1\}^\{N\}\(1\-\\alpha\_\{i\}\)\(1\-p\)\\;=\\;N\(1\-\\alpha\)\(1\-p\)\.\(51\)
Step 2: variance of each indicator\.EachWi∈\{0,1\}W\_\{i\}\\in\\\{0,1\\\}is Bernoulli, so

Var​\(Wi\)=𝔼​Wi​\(1−𝔼​Wi\)≤14,\\mathrm\{Var\}\(W\_\{i\}\)\\;=\\;\\mathbb\{E\}W\_\{i\}\\,\(1\-\\mathbb\{E\}W\_\{i\}\)\\;\\leq\\;\\tfrac\{1\}\{4\},\(52\)where the inequality is the Bernoulli\-variance bound \(x​\(1−x\)≤1/4x\(1\-x\)\\leq 1/4on\[0,1\]\[0,1\], attained atx=1/2x=1/2\)\.

Step 3: pairwise covariance bound\.The hypothesis \(equicorrelated indicators\) gives, fori≠ji\\neq j,

Cov​\(Wi,Wj\)≤γ¯W​Var​\(Wi\)​Var​\(Wj\)≤γ¯W4,\\mathrm\{Cov\}\(W\_\{i\},W\_\{j\}\)\\;\\leq\\;\\bar\{\\gamma\}\_\{W\}\\sqrt\{\\mathrm\{Var\}\(W\_\{i\}\)\\mathrm\{Var\}\(W\_\{j\}\)\}\\;\\leq\\;\\tfrac\{\\bar\{\\gamma\}\_\{W\}\}\{4\},\(53\)where the second inequality combines \([52](https://arxiv.org/html/2606.30931#A1.E52)\) on both factors\.

Step 4: variance of the count\.By definition of variance for sums,

Var​\(∑i=1NWi\)=∑i=1NVar​\(Wi\)\+∑i≠jCov​\(Wi,Wj\)\.\\mathrm\{Var\}\\\!\\left\(\\sum\_\{i=1\}^\{N\}W\_\{i\}\\right\)\\;=\\;\\sum\_\{i=1\}^\{N\}\\mathrm\{Var\}\(W\_\{i\}\)\+\\sum\_\{i\\neq j\}\\mathrm\{Cov\}\(W\_\{i\},W\_\{j\}\)\.There areNNdiagonal terms andN​\(N−1\)N\(N\-1\)off\-diagonal terms\. Substituting \([52](https://arxiv.org/html/2606.30931#A1.E52)\) on the diagonal and \([53](https://arxiv.org/html/2606.30931#A1.E53)\) off\-diagonal:

Var​\(∑iWi\)\\displaystyle\\mathrm\{Var\}\\\!\\left\(\\sum\_\{i\}W\_\{i\}\\right\)≤N⋅14\+N​\(N−1\)⋅γ¯W4\\displaystyle\\;\\leq\\;N\\cdot\\tfrac\{1\}\{4\}\+N\(N\-1\)\\cdot\\tfrac\{\\bar\{\\gamma\}\_\{W\}\}\{4\}=N4​\(1\+\(N−1\)​γ¯W\)=N24​Neff,\\displaystyle\\;=\\;\\tfrac\{N\}\{4\}\\big\(1\+\(N\-1\)\\bar\{\\gamma\}\_\{W\}\\big\)\\;=\\;\\tfrac\{N^\{2\}\}\{4N\_\{\\mathrm\{eff\}\}\},\(54\)where the last equality usesNeff=N/\(1\+\(N−1\)​γ¯W\)N\_\{\\mathrm\{eff\}\}=N/\(1\+\(N\-1\)\\bar\{\\gamma\}\_\{W\}\)\. Sanity check: atγ¯W=0\\bar\{\\gamma\}\_\{W\}=0\(independence\),Neff=NN\_\{\\mathrm\{eff\}\}=NandVar​\(∑iWi\)≤N/4\\mathrm\{Var\}\(\\sum\_\{i\}W\_\{i\}\)\\leq N/4, the standard Bernoulli\-sum variance\. Atγ¯W=1\\bar\{\\gamma\}\_\{W\}=1\(perfect correlation\),Neff=1N\_\{\\mathrm\{eff\}\}=1andVar​\(∑iWi\)≤N2/4\\mathrm\{Var\}\(\\sum\_\{i\}W\_\{i\}\)\\leq N^\{2\}/4, matching the caseW1=⋯=WNW\_\{1\}=\\cdots=W\_\{N\}whereVar​\(∑iWi\)=N2​Var​\(W1\)≤N2/4\\mathrm\{Var\}\(\\sum\_\{i\}W\_\{i\}\)=N^\{2\}\\mathrm\{Var\}\(W\_\{1\}\)\\leq N^\{2\}/4\.

Step 5: lower\-deviation Chebyshev inequality\.For any random variableXXwith finite variance and anyu\>0u\>0,

Pr⁡\[X≤𝔼​X−u​N\]≤Pr⁡\[\|X−𝔼​X\|≥u​N\]≤Var​\(X\)\(u​N\)2,\\Pr\[X\\leq\\mathbb\{E\}X\-uN\]\\;\\leq\\;\\Pr\[\|X\-\\mathbb\{E\}X\|\\geq uN\]\\;\\leq\\;\\frac\{\\mathrm\{Var\}\(X\)\}\{\(uN\)^\{2\}\},by Chebyshev’s inequality applied to the deviation\|X−𝔼​X\|\|X\-\\mathbb\{E\}X\|\. Applying this toX=∑iWiX=\\sum\_\{i\}W\_\{i\}with meanμN\\mu\_\{N\}and using \([54](https://arxiv.org/html/2606.30931#A1.E54)\):

Pr⁡\[∑iWi≤μN−u​N\]≤Var​\(∑iWi\)\(u​N\)2≤N2/\(4​Neff\)u2​N2=14​u2​Neff\.\\Pr\\\!\\left\[\\sum\_\{i\}W\_\{i\}\\leq\\mu\_\{N\}\-uN\\right\]\\;\\leq\\;\\frac\{\\mathrm\{Var\}\(\\sum\_\{i\}W\_\{i\}\)\}\{\(uN\)^\{2\}\}\\;\\leq\\;\\frac\{N^\{2\}/\(4N\_\{\\mathrm\{eff\}\}\)\}\{u^\{2\}N^\{2\}\}\\;=\\;\\frac\{1\}\{4u^\{2\}N\_\{\\mathrm\{eff\}\}\}\.\(55\)
Step 6: calibrateppanduuto the slackβ\\beta\.We want the deviation event in \([55](https://arxiv.org/html/2606.30931#A1.E55)\) to imply the failure of the cluster bound∑iWi≥\(1−α−β\)​N\\sum\_\{i\}W\_\{i\}\\geq\(1\-\\alpha\-\\beta\)N\. By \([51](https://arxiv.org/html/2606.30931#A1.E51)\),μN−u​N≥\(1−α\)​\(1−p\)​N−u​N=\(\(1−α\)​\(1−p\)−u\)​N\\mu\_\{N\}\-uN\\geq\(1\-\\alpha\)\(1\-p\)N\-uN=\(\(1\-\\alpha\)\(1\-p\)\-u\)N\. We require\(1−α\)​\(1−p\)−u≥1−α−β\(1\-\\alpha\)\(1\-p\)\-u\\geq 1\-\\alpha\-\\beta, which rearranges to

\(1−α\)​p\+u≤β\.\(1\-\\alpha\)\\,p\\;\+\\;u\\;\\leq\\;\\beta\.This is exactly the constraint that appeared in Lemma[2](https://arxiv.org/html/2606.30931#Thmlemma2)’s Step 3\. Splittingβ\\betaequally between the per\-sample tailppand the count\-deviationuu, choose

p=β2​\(1−α\),u=β2\.p\\;=\\;\\frac\{\\beta\}\{2\(1\-\\alpha\)\},\\qquad u\\;=\\;\\frac\{\\beta\}\{2\}\.\(56\)Then\(1−α\)​p=β/2\(1\-\\alpha\)p=\\beta/2andu=β/2u=\\beta/2, summing toβ\\betaexactly\.

Step 7: failure\-probability bound\.Substitutingu=β/2u=\\beta/2from \([56](https://arxiv.org/html/2606.30931#A1.E56)\) into \([55](https://arxiv.org/html/2606.30931#A1.E55)\):

Pr⁡\[∑iWi≤μN−\(β/2\)​N\]≤14​\(β/2\)2​Neff=1β2​Neff\.\\Pr\\\!\\left\[\\sum\_\{i\}W\_\{i\}\\leq\\mu\_\{N\}\-\(\\beta/2\)N\\right\]\\;\\leq\\;\\frac\{1\}\{4\(\\beta/2\)^\{2\}N\_\{\\mathrm\{eff\}\}\}\\;=\\;\\frac\{1\}\{\\beta^\{2\}N\_\{\\mathrm\{eff\}\}\}\.By the calibration of Step 6,μN−\(β/2\)​N≥\(1−α−β\)​N\\mu\_\{N\}\-\(\\beta/2\)N\\geq\(1\-\\alpha\-\\beta\)N, so

Pr⁡\[∑i=1NWi<\(1−α−β\)​N\]≤1β2​Neff,\\Pr\\\!\\left\[\\sum\_\{i=1\}^\{N\}W\_\{i\}<\(1\-\\alpha\-\\beta\)N\\right\]\\;\\leq\\;\\frac\{1\}\{\\beta^\{2\}N\_\{\\mathrm\{eff\}\}\},\(57\)which is \([20](https://arxiv.org/html/2606.30931#S5.E20)\)\.

Step 8: cluster radius \(unchanged from Lemma[2](https://arxiv.org/html/2606.30931#Thmlemma2)\)\.Substitutingp=β/\(2​\(1−α\)\)p=\\beta/\(2\(1\-\\alpha\)\)from \([56](https://arxiv.org/html/2606.30931#A1.E56)\) into the per\-sample tail\-radiusρp=σ​\(C1​d\+\(1/c\)​log⁡\(1/p\)\)\\rho\_\{p\}=\\sigma\(C\_\{1\}\\sqrt\{d\}\+\\sqrt\{\(1/c\)\\log\(1/p\)\}\)\(equation \([39](https://arxiv.org/html/2606.30931#A1.E39)\) of Lemma[2](https://arxiv.org/html/2606.30931#Thmlemma2)’s proof\) gives the same cluster radius as Theorem[1](https://arxiv.org/html/2606.30931#Thmtheorem1):

ρ=σ​\(C1​d\+1c​log⁡2​\(1−α\)β\)\.\\rho\\;=\\;\\sigma\\\!\\left\(C\_\{1\}\\sqrt\{d\}\\;\+\\;\\sqrt\{\\tfrac\{1\}\{c\}\\log\\tfrac\{2\(1\-\\alpha\)\}\{\\beta\}\}\\right\)\.This step uses only the per\-sample sub\-Gaussian tail and is correlation\-free\.

Step 9: deterministic geometric step \(Lemma[1](https://arxiv.org/html/2606.30931#Thmlemma1)\)\.On the complementary event of \([57](https://arxiv.org/html/2606.30931#A1.E57)\), which has probability≥1−1/\(β2​Neff\)\\geq 1\-1/\(\\beta^\{2\}N\_\{\\mathrm\{eff\}\}\), the count of cluster\-near judges satisfies

\|\{i∈\[N\]:‖𝐲^i−𝐲⋆‖2≤ρ\}\|≥∑i=1NWi≥\(1−α−β\)​N=\(1−\(α\+β\)\)​N\.\\big\|\\big\\\{i\\in\[N\]:\\\|\\hat\{\{\\mathbf\{y\}\}\}\_\{i\}\-\{\\mathbf\{y\}\}^\{\\star\}\\\|\_\{2\}\\leq\\rho\\big\\\}\\big\|\\;\\geq\\;\\sum\_\{i=1\}^\{N\}W\_\{i\}\\;\\geq\\;\(1\-\\alpha\-\\beta\)N\\;=\\;\(1\-\(\\alpha\+\\beta\)\)N\.Apply Lemma[1](https://arxiv.org/html/2606.30931#Thmlemma1)with the substitutionsk=Nk=N,z=𝐲⋆z=\{\\mathbf\{y\}\}^\{\\star\},r=ρr=\\rho,α′=α\+β\\alpha^\{\\prime\}=\\alpha\+\\beta\(which lies in\(0,1/2\)\(0,1/2\)sinceβ∈\(0,1/2−α\)\\beta\\in\(0,1/2\-\\alpha\)\); the lemma’s hypothesis is exactly the count bound above\. The conclusion gives‖𝐲^GM−𝐲⋆‖2≤Cα\+β​ρ\\\|\\hat\{\{\\mathbf\{y\}\}\}\_\{\\mathrm\{GM\}\}\-\{\\mathbf\{y\}\}^\{\\star\}\\\|\_\{2\}\\leq C\_\{\\alpha\+\\beta\}\\,\\rhowithCα\+βC\_\{\\alpha\+\\beta\}andρ\\rhounchanged from Theorem[1](https://arxiv.org/html/2606.30931#Thmtheorem1)\.

Step 10: assemble\.Combining the deterministic bound from Step 9 \(which holds on the complementary event\) with the failure probability \([57](https://arxiv.org/html/2606.30931#A1.E57)\):

Pr⁡\[‖𝐲^GM−𝐲⋆‖2≤Cα\+β​ρ\]≥1−1β2​Neff,\\Pr\\\!\\Big\[\\,\\\|\\hat\{\{\\mathbf\{y\}\}\}\_\{\\mathrm\{GM\}\}\-\{\\mathbf\{y\}\}^\{\\star\}\\\|\_\{2\}\\;\\leq\\;C\_\{\\alpha\+\\beta\}\\,\\rho\\,\\Big\]\\;\\geq\\;1\-\\frac\{1\}\{\\beta^\{2\}N\_\{\\mathrm\{eff\}\}\},which is the statement of Lemma[3](https://arxiv.org/html/2606.30931#Thmlemma3)\. ∎

### A\.9Proof of Theorem[2](https://arxiv.org/html/2606.30931#Thmtheorem2)

Theorem[1](https://arxiv.org/html/2606.30931#Thmtheorem1)provides an upper bound on the error of the geometric median\. A natural question is whether this rate can be improved by*any*estimator\. The following result shows that, in the parametric regime, it cannot\.

For convenience we restate Theorem[2](https://arxiv.org/html/2606.30931#Thmtheorem2): under the observation model \([8](https://arxiv.org/html/2606.30931#S3.E8)\) withNNjudges inℝd\\mathbb\{R\}^\{d\}, homogeneous contamination rateα<1/2\\alpha<1/2, andσ2\\sigma^\{2\}\-sub\-Gaussian competent noise \(Assumptions[2](https://arxiv.org/html/2606.30931#Thmassumption2),[3](https://arxiv.org/html/2606.30931#Thmassumption3),[4](https://arxiv.org/html/2606.30931#Thmassumption4),[5](https://arxiv.org/html/2606.30931#Thmassumption5)\), there exists a universal constantc\>0c\>0such that

inf𝐲^supF∈ℱα,σ𝔼F​\[‖𝐲^−𝐲⋆‖2\]≥c​σ​\(d/N\+α1−α\)\.\\inf\_\{\\hat\{\{\\mathbf\{y\}\}\}\}\\;\\sup\_\{F\\in\{\\mathcal\{F\}\}\_\{\\alpha,\\sigma\}\}\\;\\mathbb\{E\}\_\{F\}\\\!\\left\[\\big\\\|\\hat\{\{\\mathbf\{y\}\}\}\-\{\\mathbf\{y\}\}^\{\\star\}\\big\\\|\_\{2\}\\right\]\\;\\geq\\;c\\,\\sigma\\\!\\left\(\\sqrt\{d/N\}\\;\+\\;\\frac\{\\alpha\}\{1\-\\alpha\}\\right\)\.\(58\)
###### Proof of Theorem[2](https://arxiv.org/html/2606.30931#Thmtheorem2)\.

We invoke Le Cam’s two\-point method\(Tsybakov,[2009](https://arxiv.org/html/2606.30931#bib.bib41), Sec\. 2\.4\): for any two parameter values𝐲0,𝐲1∈ℝd\{\\mathbf\{y\}\}\_\{0\},\{\\mathbf\{y\}\}\_\{1\}\\in\\mathbb\{R\}^\{d\}inducing observation distributionsF0,F1∈ℱα,σF\_\{0\},F\_\{1\}\\in\{\\mathcal\{F\}\}\_\{\\alpha,\\sigma\},

inf𝐲^supF∈\{F0,F1\}𝔼F​\[‖𝐲^−𝐲⋆‖2\]≥‖𝐲0−𝐲1‖24⋅\(1−TV​\(F0⊗N,F1⊗N\)\)\.\\inf\_\{\\hat\{\{\\mathbf\{y\}\}\}\}\\;\\sup\_\{F\\in\\\{F\_\{0\},F\_\{1\}\\\}\}\\;\\mathbb\{E\}\_\{F\}\\\!\\left\[\\\|\\hat\{\{\\mathbf\{y\}\}\}\-\{\\mathbf\{y\}\}^\{\\star\}\\\|\_\{2\}\\right\]\\;\\geq\\;\\frac\{\\\|\{\\mathbf\{y\}\}\_\{0\}\-\{\\mathbf\{y\}\}\_\{1\}\\\|\_\{2\}\}\{4\}\\cdot\\left\(1\-\\mathrm\{TV\}\(F\_\{0\}^\{\\otimes N\},F\_\{1\}^\{\\otimes N\}\)\\right\)\.\(59\)The strategy is to construct\(𝐲0,𝐲1,F0,F1\)\(\{\\mathbf\{y\}\}\_\{0\},\{\\mathbf\{y\}\}\_\{1\},F\_\{0\},F\_\{1\}\)maximising the right\-hand side\. Part 1 controls the parametric variance term; Part 2 establishes theNN\-independent breakdown floor via the modulus of continuity of the Huber neighborhood\.

Part 1: thed/N\\sqrt\{d/N\}term, via Fano’s inequality\.Setα=0\\alpha=0and consider the clean Gaussian sub\-familyF=𝒩​\(𝐲⋆,σ2​𝐈d\)F=\{\\mathcal\{N\}\}\(\{\\mathbf\{y\}\}^\{\\star\},\\sigma^\{2\}\{\\mathbf\{I\}\}\_\{d\}\)for alli∈\[N\]i\\in\[N\]\. The Le Cam two\-point bound \([59](https://arxiv.org/html/2606.30931#A1.E59)\) alone cannot deliver thed\\sqrt\{d\}factor \(two Gaussians at separationΔ\\DeltahaveTV→1\\mathrm\{TV\}\\to 1onceΔ≳σ\\Delta\\gtrsim\\sigma, regardless ofdd\); we therefore use the multi\-hypothesis generalisation, Fano’s inequality\.

*Step 1\.1 \(Gilbert–Varshamov packing ofℝd\\mathbb\{R\}^\{d\}\)\.*For radiusΔ\>0\\Delta\>0, by the Gilbert–Varshamov bound\(Massart,[2007](https://arxiv.org/html/2606.30931#bib.bib44), Lem\. 4\.7\)there exists a packing\{𝐲1,…,𝐲M\}⊂ℝd\\\{\{\\mathbf\{y\}\}\_\{1\},\\ldots,\{\\mathbf\{y\}\}\_\{M\}\\\}\\subset\\mathbb\{R\}^\{d\}with

‖𝐲m−𝐲m′‖2≥Δfor all​m≠m′,M≥2d/8\.\\\|\{\\mathbf\{y\}\}\_\{m\}\-\{\\mathbf\{y\}\}\_\{m^\{\\prime\}\}\\\|\_\{2\}\\;\\geq\\;\\Delta\\quad\\text\{for all \}m\\neq m^\{\\prime\},\\qquad M\\;\\geq\\;2^\{d/8\}\.\(60\)\(Concretely, take the packing scaled so each𝐲m\{\\mathbf\{y\}\}\_\{m\}has‖𝐲m‖2≤Δ\\\|\{\\mathbf\{y\}\}\_\{m\}\\\|\_\{2\}\\leq\\Delta\.\)

*Step 1\.2 \(Fano’s inequality\)\.*LetHmH\_\{m\}be the hypothesis𝐲⋆=𝐲m\{\\mathbf\{y\}\}^\{\\star\}=\{\\mathbf\{y\}\}\_\{m\}; underHmH\_\{m\}, the joint observation law isFm⊗N=𝒩​\(𝐲m,σ2​𝐈d\)⊗NF\_\{m\}^\{\\otimes N\}=\{\\mathcal\{N\}\}\(\{\\mathbf\{y\}\}\_\{m\},\\sigma^\{2\}\{\\mathbf\{I\}\}\_\{d\}\)^\{\\otimes N\}\. Fano’s inequality\(Tsybakov,[2009](https://arxiv.org/html/2606.30931#bib.bib41), Cor\. 2\.6\)gives, for any estimator𝐲^\\hat\{\{\\mathbf\{y\}\}\},

1M​∑m=1MPrHm⁡\[‖𝐲^−𝐲m‖2≥Δ/2\]≥1−KL¯\+log⁡2log⁡M,\\frac\{1\}\{M\}\\sum\_\{m=1\}^\{M\}\\Pr\_\{H\_\{m\}\}\\\!\\big\[\\\|\\hat\{\{\\mathbf\{y\}\}\}\-\{\\mathbf\{y\}\}\_\{m\}\\\|\_\{2\}\\geq\\Delta/2\\big\]\\;\\geq\\;1\-\\frac\{\\bar\{\\mathrm\{KL\}\}\+\\log 2\}\{\\log M\},\(61\)whereKL¯=\(M2\)−1​∑m<m′KL​\(Fm⊗N∥Fm′⊗N\)\\bar\{\\mathrm\{KL\}\}=\\binom\{M\}\{2\}^\{\-1\}\\sum\_\{m<m^\{\\prime\}\}\\mathrm\{KL\}\(F\_\{m\}^\{\\otimes N\}\\,\\\|\\,F\_\{m^\{\\prime\}\}^\{\\otimes N\}\)\. For two product Gaussians,KL​\(Fm⊗N∥Fm′⊗N\)=N​‖𝐲m−𝐲m′‖22/\(2​σ2\)≤N​Δ2/\(2​σ2\)\\mathrm\{KL\}\(F\_\{m\}^\{\\otimes N\}\\,\\\|\\,F\_\{m^\{\\prime\}\}^\{\\otimes N\}\)=N\\\|\{\\mathbf\{y\}\}\_\{m\}\-\{\\mathbf\{y\}\}\_\{m^\{\\prime\}\}\\\|\_\{2\}^\{2\}/\(2\\sigma^\{2\}\)\\leq N\\Delta^\{2\}/\(2\\sigma^\{2\}\)\(using‖𝐲m‖2≤Δ\\\|\{\\mathbf\{y\}\}\_\{m\}\\\|\_\{2\}\\leq\\Deltaand the triangle inequality\)\.

*Step 1\.3 \(ChooseΔ\\Deltato make the right\-hand side≥1/2\\geq 1/2\)\.*Withlog⁡M≥d​log⁡2/8\\log M\\geq d\\log 2/8andKL¯≤N​Δ2/\(2​σ2\)\\bar\{\\mathrm\{KL\}\}\\leq N\\Delta^\{2\}/\(2\\sigma^\{2\}\), the right\-hand side of \([61](https://arxiv.org/html/2606.30931#A1.E61)\) is at least1/21/2provided

N​Δ2/\(2​σ2\)\+log⁡2d​log⁡2/8≤12,\\frac\{N\\Delta^\{2\}/\(2\\sigma^\{2\}\)\+\\log 2\}\{d\\log 2/8\}\\;\\leq\\;\\tfrac\{1\}\{2\},which \(ford≥16d\\geq 16, harmlessly absorbing thelog⁡2\\log 2\) holds whenΔ=c1​σ​d/N\\Delta=c\_\{1\}\\sigma\\sqrt\{d/N\}for a sufficiently small absolute constantc1\>0c\_\{1\}\>0\.

*Step 1\.4 \(Convert to expected error\)\.*On the event‖𝐲^−𝐲m‖2≥Δ/2\\\|\\hat\{\{\\mathbf\{y\}\}\}\-\{\\mathbf\{y\}\}\_\{m\}\\\|\_\{2\}\\geq\\Delta/2, Markov’s inequality gives𝔼​‖𝐲^−𝐲m‖2≥\(Δ/2\)⋅Pr⁡\[⋅\]≥Δ/4\\mathbb\{E\}\\\|\\hat\{\{\\mathbf\{y\}\}\}\-\{\\mathbf\{y\}\}\_\{m\}\\\|\_\{2\}\\geq\(\\Delta/2\)\\cdot\\Pr\[\\cdot\]\\geq\\Delta/4, so

supm𝔼Hm​‖𝐲^−𝐲m‖2≥1M​∑m=1M𝔼Hm​‖𝐲^−𝐲m‖2≥Δ/4=c14​σ​d/N\.\\sup\_\{m\}\\mathbb\{E\}\_\{H\_\{m\}\}\\\|\\hat\{\{\\mathbf\{y\}\}\}\-\{\\mathbf\{y\}\}\_\{m\}\\\|\_\{2\}\\;\\geq\\;\\frac\{1\}\{M\}\\sum\_\{m=1\}^\{M\}\\mathbb\{E\}\_\{H\_\{m\}\}\\\|\\hat\{\{\\mathbf\{y\}\}\}\-\{\\mathbf\{y\}\}\_\{m\}\\\|\_\{2\}\\;\\geq\\;\\Delta/4\\;=\\;\\tfrac\{c\_\{1\}\}\{4\}\\sigma\\sqrt\{d/N\}\.EachHmH\_\{m\}corresponds to a clean \(α=0\\alpha=0\) instance inℱα,σ\{\\mathcal\{F\}\}\_\{\\alpha,\\sigma\}, so this lower bound holds over the worst\-caseF∈ℱα,σF\\in\{\\mathcal\{F\}\}\_\{\\alpha,\\sigma\}, establishing thed/N\\sqrt\{d/N\}term\.

Part 2: theα/\(1−α\)\\alpha/\(1\-\\alpha\)term, via the modulus of continuity\.The breakdown floor is dimension\-free inddand*independent ofNN*; we establish it through the structural fact that two Huber neighborhoods at sufficiently close centers have a common element, hence are statistically indistinguishable\.

Step 2\.1 \(Modulus of continuity for Huber neighborhoods\)\.For a center𝐲∈ℝd\{\\mathbf\{y\}\}\\in\\mathbb\{R\}^\{d\}, writeℱα​\(𝐲\)=\{\(1−α\)​𝒩​\(𝐲,σ2​𝐈d\)\+α​Q:Q​probability on​ℝd\}\{\\mathcal\{F\}\}\_\{\\alpha\}\(\{\\mathbf\{y\}\}\)=\\\{\(1\-\\alpha\)\{\\mathcal\{N\}\}\(\{\\mathbf\{y\}\},\\sigma^\{2\}\{\\mathbf\{I\}\}\_\{d\}\)\+\\alpha Q:Q\\text\{ probability on \}\\mathbb\{R\}^\{d\}\\\}for the corresponding Huber contamination class\. We claim a sufficient condition for two such neighborhoods to overlap:

‖𝒩​\(𝐲0,σ2​𝐈d\)−𝒩​\(𝐲1,σ2​𝐈d\)‖TV≤α1−α⟹ℱα​\(𝐲0\)∩ℱα​\(𝐲1\)≠∅\.\\big\\\|\{\\mathcal\{N\}\}\(\{\\mathbf\{y\}\}\_\{0\},\\sigma^\{2\}\{\\mathbf\{I\}\}\_\{d\}\)\-\{\\mathcal\{N\}\}\(\{\\mathbf\{y\}\}\_\{1\},\\sigma^\{2\}\{\\mathbf\{I\}\}\_\{d\}\)\\big\\\|\_\{\\mathrm\{TV\}\}\\;\\leq\\;\\frac\{\\alpha\}\{1\-\\alpha\}\\quad\\Longrightarrow\\quad\{\\mathcal\{F\}\}\_\{\\alpha\}\(\{\\mathbf\{y\}\}\_\{0\}\)\\cap\{\\mathcal\{F\}\}\_\{\\alpha\}\(\{\\mathbf\{y\}\}\_\{1\}\)\\neq\\emptyset\.\(62\)*Proof of \([62](https://arxiv.org/html/2606.30931#A1.E62)\)\.*LetPj=𝒩​\(𝐲j,σ2​𝐈d\)P\_\{j\}=\{\\mathcal\{N\}\}\(\{\\mathbf\{y\}\}\_\{j\},\\sigma^\{2\}\{\\mathbf\{I\}\}\_\{d\}\)and writeϵ=‖P0−P1‖TV\{\\epsilon\}=\\\|P\_\{0\}\-P\_\{1\}\\\|\_\{\\mathrm\{TV\}\}; the hypothesis isϵ≤α/\(1−α\)\{\\epsilon\}\\leq\\alpha/\(1\-\\alpha\)\. Hahn\-decompose the signed measureP0−P1=μ\+−μ−P\_\{0\}\-P\_\{1\}=\\mu^\{\+\}\-\\mu^\{\-\}withμ\+,μ−≥0\\mu^\{\+\},\\mu^\{\-\}\\geq 0andμ\+​\(ℝd\)=μ−​\(ℝd\)=ϵ\\mu^\{\+\}\(\\mathbb\{R\}^\{d\}\)=\\mu^\{\-\}\(\\mathbb\{R\}^\{d\}\)=\{\\epsilon\}\. Pick any probability measureρ\\rho\(e\.g\.ρ=\(P0\+P1\)/2\\rho=\(P\_\{0\}\+P\_\{1\}\)/2\), and define the candidates

α​Q0≜\(1−α\)​μ−\+\(α−\(1−α\)​ϵ\)​ρ,α​Q1≜\(1−α\)​μ\+\+\(α−\(1−α\)​ϵ\)​ρ\.\\alpha Q\_\{0\}\\;\\triangleq\\;\(1\-\\alpha\)\\mu^\{\-\}\+\\big\(\\alpha\-\(1\-\\alpha\)\{\\epsilon\}\\big\)\\rho,\\qquad\\alpha Q\_\{1\}\\;\\triangleq\\;\(1\-\\alpha\)\\mu^\{\+\}\+\\big\(\\alpha\-\(1\-\\alpha\)\{\\epsilon\}\\big\)\\rho\.\(63\)EachQjQ\_\{j\}is a probability measure: nonnegativity holds becauseμ±≥0\\mu^\{\\pm\}\\geq 0,ρ≥0\\rho\\geq 0, and the hypothesisϵ≤α/\(1−α\)\{\\epsilon\}\\leq\\alpha/\(1\-\\alpha\)ensuresα−\(1−α\)​ϵ≥0\\alpha\-\(1\-\\alpha\)\{\\epsilon\}\\geq 0; total mass isα​Qj​\(ℝd\)=\(1−α\)​ϵ\+\(α−\(1−α\)​ϵ\)=α\\alpha Q\_\{j\}\(\\mathbb\{R\}^\{d\}\)=\(1\-\\alpha\)\{\\epsilon\}\+\(\\alpha\-\(1\-\\alpha\)\{\\epsilon\}\)=\\alpha, soQj​\(ℝd\)=1Q\_\{j\}\(\\mathbb\{R\}^\{d\}\)=1\. Subtracting the two Huber mixtures:

\[\(1−α\)​P0\+α​Q0\]−\[\(1−α\)​P1\+α​Q1\]\\displaystyle\\big\[\(1\-\\alpha\)P\_\{0\}\+\\alpha Q\_\{0\}\\big\]\-\\big\[\(1\-\\alpha\)P\_\{1\}\+\\alpha Q\_\{1\}\\big\]=\(1−α\)​\(P0−P1\)\+α​\(Q0−Q1\)\\displaystyle=\(1\-\\alpha\)\(P\_\{0\}\-P\_\{1\}\)\+\\alpha\(Q\_\{0\}\-Q\_\{1\}\)=\(1−α\)​\(μ\+−μ−\)\+\(1−α\)​\(μ−−μ\+\)\\displaystyle=\(1\-\\alpha\)\(\\mu^\{\+\}\-\\mu^\{\-\}\)\+\(1\-\\alpha\)\(\\mu^\{\-\}\-\\mu^\{\+\}\)=0,\\displaystyle=0,using \([63](https://arxiv.org/html/2606.30931#A1.E63)\) \(theρ\\rhoterms cancel\)\. Hence\(1−α\)​P0\+α​Q0=\(1−α\)​P1\+α​Q1\(1\-\\alpha\)P\_\{0\}\+\\alpha Q\_\{0\}=\(1\-\\alpha\)P\_\{1\}\+\\alpha Q\_\{1\}is a common element ofℱα​\(𝐲0\)∩ℱα​\(𝐲1\)\{\\mathcal\{F\}\}\_\{\\alpha\}\(\{\\mathbf\{y\}\}\_\{0\}\)\\cap\{\\mathcal\{F\}\}\_\{\\alpha\}\(\{\\mathbf\{y\}\}\_\{1\}\), establishing \([62](https://arxiv.org/html/2606.30931#A1.E62)\)\.

Step 2\.2 \(Equal\-covariance Gaussian TV is dimension\-free\)\.The total\-variation distance between𝒩​\(𝐲0,σ2​𝐈d\)\{\\mathcal\{N\}\}\(\{\\mathbf\{y\}\}\_\{0\},\\sigma^\{2\}\{\\mathbf\{I\}\}\_\{d\}\)and𝒩​\(𝐲1,σ2​𝐈d\)\{\\mathcal\{N\}\}\(\{\\mathbf\{y\}\}\_\{1\},\\sigma^\{2\}\{\\mathbf\{I\}\}\_\{d\}\)depends only onΔ≜‖𝐲0−𝐲1‖2\\Delta\\triangleq\\\|\{\\mathbf\{y\}\}\_\{0\}\-\{\\mathbf\{y\}\}\_\{1\}\\\|\_\{2\}: projecting onto the line𝐲1−𝐲0\{\\mathbf\{y\}\}\_\{1\}\-\{\\mathbf\{y\}\}\_\{0\}reduces the comparison to two univariate Gaussians at separationΔ\\Deltawith varianceσ2\\sigma^\{2\}, and the orthogonal directions contribute identical factors that cancel in TV\. Therefore

‖𝒩​\(𝐲0,σ2​𝐈d\)−𝒩​\(𝐲1,σ2​𝐈d\)‖TV=2​Φ​\(Δ2​σ\)−1,\\big\\\|\{\\mathcal\{N\}\}\(\{\\mathbf\{y\}\}\_\{0\},\\sigma^\{2\}\{\\mathbf\{I\}\}\_\{d\}\)\-\{\\mathcal\{N\}\}\(\{\\mathbf\{y\}\}\_\{1\},\\sigma^\{2\}\{\\mathbf\{I\}\}\_\{d\}\)\\big\\\|\_\{\\mathrm\{TV\}\}\\;=\\;2\\Phi\\\!\\left\(\\tfrac\{\\Delta\}\{2\\sigma\}\\right\)\-1,\(64\)withΦ\\Phithe standard normal cdf\.

Step 2\.3 \(Solve for the indistinguishability separation\)\.Combining \([62](https://arxiv.org/html/2606.30931#A1.E62)\) and \([64](https://arxiv.org/html/2606.30931#A1.E64)\),ℱα​\(𝐲0\)∩ℱα​\(𝐲1\)≠∅\{\\mathcal\{F\}\}\_\{\\alpha\}\(\{\\mathbf\{y\}\}\_\{0\}\)\\cap\{\\mathcal\{F\}\}\_\{\\alpha\}\(\{\\mathbf\{y\}\}\_\{1\}\)\\neq\\emptysetwhenever

2​Φ​\(Δ/\(2​σ\)\)−1≤α/\(1−α\),i\.e\.Δ≤Δ⋆≜2​σ​Φ−1​\(12\+α2​\(1−α\)\)\.2\\Phi\(\\Delta/\(2\\sigma\)\)\-1\\;\\leq\\;\\alpha/\(1\-\\alpha\),\\qquad\\text\{i\.e\.\}\\qquad\\Delta\\;\\leq\\;\\Delta\_\{\\star\}\\;\\triangleq\\;2\\sigma\\,\\Phi^\{\-1\}\\\!\\left\(\\tfrac\{1\}\{2\}\+\\tfrac\{\\alpha\}\{2\(1\-\\alpha\)\}\\right\)\.We lower\-boundΦ−1\\Phi^\{\-1\}by integrating its density: for anyy∈\[0,1/2\)y\\in\[0,1/2\)andx=Φ−1​\(1/2\+y\)≥0x=\\Phi^\{\-1\}\(1/2\+y\)\\geq 0,

y=Φ​\(x\)−12=∫0xϕ​\(t\)​𝑑t≤x⋅maxt≥0⁡ϕ​\(t\)=x⋅ϕ​\(0\)=x2​π,y\\;=\\;\\Phi\(x\)\-\\tfrac\{1\}\{2\}\\;=\\;\\int\_\{0\}^\{x\}\\phi\(t\)\\,dt\\;\\leq\\;x\\cdot\\max\_\{t\\geq 0\}\\phi\(t\)\\;=\\;x\\cdot\\phi\(0\)\\;=\\;\\frac\{x\}\{\\sqrt\{2\\pi\}\},where the maximum of the standard normal density on\[0,∞\)\[0,\\infty\)is attained at0withϕ​\(0\)=1/2​π\\phi\(0\)=1/\\sqrt\{2\\pi\}\. HenceΦ−1​\(1/2\+y\)≥y​2​π\\Phi^\{\-1\}\(1/2\+y\)\\geq y\\sqrt\{2\\pi\}for ally∈\[0,1/2\)y\\in\[0,1/2\)\. Applying this withy=α/\(2​\(1−α\)\)y=\\alpha/\(2\(1\-\\alpha\)\)\(which lies in\[0,1/2\)\[0,1/2\)for allα∈\[0,1/2\)\\alpha\\in\[0,1/2\)\):

Φ−1​\(12\+α2​\(1−α\)\)≥α2​\(1−α\)⋅2​π=π2​α1−α\.\\Phi^\{\-1\}\\\!\\left\(\\tfrac\{1\}\{2\}\+\\tfrac\{\\alpha\}\{2\(1\-\\alpha\)\}\\right\)\\;\\geq\\;\\tfrac\{\\alpha\}\{2\(1\-\\alpha\)\}\\cdot\\sqrt\{2\\pi\}\\;=\\;\\sqrt\{\\tfrac\{\\pi\}\{2\}\}\\,\\frac\{\\alpha\}\{1\-\\alpha\}\.Therefore

Δ⋆=2​σ​Φ−1​\(12\+α2​\(1−α\)\)≥2​σ⋅π2​α1−α=2​π​σ​α1−α\.\\Delta\_\{\\star\}\\;=\\;2\\sigma\\,\\Phi^\{\-1\}\\\!\\left\(\\tfrac\{1\}\{2\}\+\\tfrac\{\\alpha\}\{2\(1\-\\alpha\)\}\\right\)\\;\\geq\\;2\\sigma\\cdot\\sqrt\{\\tfrac\{\\pi\}\{2\}\}\\,\\frac\{\\alpha\}\{1\-\\alpha\}\\;=\\;\\sqrt\{2\\pi\}\\,\\sigma\\,\\frac\{\\alpha\}\{1\-\\alpha\}\.
Step 2\.4 \(Apply Le Cam\)\.Pick𝐲0=𝟎\{\\mathbf\{y\}\}\_\{0\}=\{\\mathbf\{0\}\},𝐲1=Δ⋆​𝐞1\{\\mathbf\{y\}\}\_\{1\}=\\Delta\_\{\\star\}\\,\{\\mathbf\{e\}\}\_\{1\}, and letFFbe any common element ofℱα​\(𝐲0\)∩ℱα​\(𝐲1\)\{\\mathcal\{F\}\}\_\{\\alpha\}\(\{\\mathbf\{y\}\}\_\{0\}\)\\cap\{\\mathcal\{F\}\}\_\{\\alpha\}\(\{\\mathbf\{y\}\}\_\{1\}\)\(which exists by Step 2\.1\)\. SetF0=F1=FF\_\{0\}=F\_\{1\}=F; thenF0⊗N=F1⊗NF\_\{0\}^\{\\otimes N\}=F\_\{1\}^\{\\otimes N\}andTV​\(F0⊗N,F1⊗N\)=0\\mathrm\{TV\}\(F\_\{0\}^\{\\otimes N\},F\_\{1\}^\{\\otimes N\}\)=0*regardless ofNN*\. Substituting into \([59](https://arxiv.org/html/2606.30931#A1.E59)\),

inf𝐲^supF∈\{F0,F1\}𝔼F​\[‖𝐲^−𝐲⋆‖2\]≥Δ⋆4≥2​π4​σ​α1−α\.\\inf\_\{\\hat\{\{\\mathbf\{y\}\}\}\}\\;\\sup\_\{F\\in\\\{F\_\{0\},F\_\{1\}\\\}\}\\;\\mathbb\{E\}\_\{F\}\\\!\\left\[\\\|\\hat\{\{\\mathbf\{y\}\}\}\-\{\\mathbf\{y\}\}^\{\\star\}\\\|\_\{2\}\\right\]\\;\\geq\\;\\frac\{\\Delta\_\{\\star\}\}\{4\}\\;\\geq\\;\\frac\{\\sqrt\{2\\pi\}\}\{4\}\\,\\sigma\\,\\frac\{\\alpha\}\{1\-\\alpha\}\.
Combining\.Taking the maximum of the two lower bounds \(the worst\-case adversary selects whichever construction is tighter\) and absorbing constants yields \([58](https://arxiv.org/html/2606.30931#A1.E58)\)\. ∎

#### Comparison with the upper bound\.

Atα=0\\alpha=0, the upper and lower bounds match at the parametric rateσ​d/N\\sigma\\sqrt\{d/N\}, confirming that the geometric median is rate\-optimal in the clean regime\. On the breakdown floor the upper bound \(Thm[1](https://arxiv.org/html/2606.30931#Thmtheorem1)\) scales asCα​σ​dC\_\{\\alpha\}\\sigma\\sqrt\{d\}while the lower bound scales asσ​α/\(1−α\)\\sigma\\alpha/\(1\-\\alpha\); the gap is ad/α\\sqrt\{d\}/\\alphafactor\. This is not slack in the analysis but a real statistical–computational gap\. The minimax\-optimal estimator on the breakdown floor is the Tukey halfspace median\(Tukey,[1975](https://arxiv.org/html/2606.30931#bib.bib36); Donoho and Gasko,[1992](https://arxiv.org/html/2606.30931#bib.bib37)\), whose exact computation is NP\-hard ford≥3d\\geq 3\(Johnson and Preparata,[1978](https://arxiv.org/html/2606.30931#bib.bib38); Aloupis,[2006](https://arxiv.org/html/2606.30931#bib.bib39)\); the smoothed\-depth estimator ofChenet al\.\([2018](https://arxiv.org/html/2606.30931#bib.bib40)\)matches theσ​α\\sigma\\alphafloor in sub\-exponential time\. The geometric median is the polynomial\-time alternative: it shares the optimal1/21/2breakdown point but pays ad\\sqrt\{d\}price forO​\(N​d​log⁡\(1/ϵ\)\)O\(Nd\\log\(1/\{\\epsilon\}\)\)tractability via the Weiszfeld iteration\. For LLM juries the trade is favourable:ddis small \(1–5 in our benchmarks\) so thed\\sqrt\{d\}overhead is at most∼2\.2×\\sim 2\.2\\times, and at smallNNthe variance termσ​d/N\\sigma\\sqrt\{d/N\}dominates the breakdown floor on every regime we test\.

## Appendix BAdditional Experiments

### B\.1Synthetic 2D Simulation: Visual Intuition

For pedagogical intuition we instantiate the observation model \([8](https://arxiv.org/html/2606.30931#S3.E8)\) ind=2d=2dimensions with score range\[0,K\]\[0,K\]and visualize five representative failure modes\. A jury ofNNjudges evaluates a single instance with latent reward𝐲⋆∈\[0,K\]2\{\\mathbf\{y\}\}^\{\\star\}\\in\[0,K\]^\{2\}\. Each competent judge \(Zi=0Z\_\{i\}=0\) draws from a tight isotropic Gaussian centered on𝐲⋆\{\\mathbf\{y\}\}^\{\\star\}; each corrupted judge \(Zi=1Z\_\{i\}=1\) draws from a corruption distributionQiQ\_\{i\}specific to the failure mode\. The corruption indicatorZi∼Bernoulli​\(α\)Z\_\{i\}\\sim\\mathrm\{Bernoulli\}\(\\alpha\)is drawn independently per judge at homogeneous rateα∈\{0\.10,0\.30,0\.40\}\\alpha\\in\\\{0\.10,0\.30,0\.40\\\}\. We compare the arithmetic mean and the geometric median \(computed via Algorithm[1](https://arxiv.org/html/2606.30931#alg1)\)\. In every figure, the gold star marks𝐲⋆\{\\mathbf\{y\}\}^\{\\star\}, blue dots are competent judge outputs, red crosses are corrupted outputs, and the orange square and purple triangle mark the arithmetic mean and the geometric median, respectively\.

#### Mode collapse \(Q=δ𝟎Q=\\delta\_\{\{\\mathbf\{0\}\}\}\)\.

The corrupted judge outputs the zero vector on every attribute—the canonical parser\-fallback failure mode \(Remark[2](https://arxiv.org/html/2606.30931#Thmremark2)\)\.[Figure˜15](https://arxiv.org/html/2606.30931#A2.F15)shows the mean pulled toward the origin asα\\alphagrows, while the geometric median remains anchored to the competent cluster\.

![Refer to caption](https://arxiv.org/html/2606.30931v1/x26.png)

![Refer to caption](https://arxiv.org/html/2606.30931v1/x27.png)α=0\.10\\alpha=0\.10
![Refer to caption](https://arxiv.org/html/2606.30931v1/)α=0\.30\\alpha=0\.30
![Refer to caption](https://arxiv.org/html/2606.30931v1/x29.png)α=0\.40\\alpha=0\.40

Figure 15:Mode Collapse corruption\(Q=δ𝟎Q=\\delta\_\{\\mathbf\{0\}\}\)\. Corrupted judges output the zero vector, modeling parser failures or safety refusals\. The mean is pulled linearly toward the origin; atα=0\.40\\alpha=0\.40it lies roughly40%40\\%of the way from𝐲⋆\\mathbf\{y\}^\{\\star\}to𝟎\\mathbf\{0\}\. The geometric median remains within the competent cluster because the majority of Euclidean distances still point toward𝐲⋆\\mathbf\{y\}^\{\\star\}\.
#### Inverted \(Q=δK⋅𝟏−𝐲⋆Q=\\delta\_\{K\\cdot\{\\mathbf\{1\}\}\-\{\\mathbf\{y\}\}^\{\\star\}\}\)\.

The worst\-case anti\-correlated Byzantine adversary \([Figure˜16](https://arxiv.org/html/2606.30931#A2.F16)\)\. This is the sharpest visual demonstration of the breakdown\-point advantage: the corrupted locus and𝐲⋆\{\\mathbf\{y\}\}^\{\\star\}lie on opposite sides of the score space, so atα=0\.30\\alpha=0\.30the mean has already crossed the midpoint while the geometric median remains within the competent cluster\.

![Refer to caption](https://arxiv.org/html/2606.30931v1/x30.png)

![Refer to caption](https://arxiv.org/html/2606.30931v1/x31.png)α=0\.10\\alpha=0\.10
![Refer to caption](https://arxiv.org/html/2606.30931v1/x32.png)α=0\.30\\alpha=0\.30
![Refer to caption](https://arxiv.org/html/2606.30931v1/x33.png)α=0\.40\\alpha=0\.40

Figure 16:Inverted corruption\(Q=δK⋅𝟏−𝐲⋆Q=\\delta\_\{K\\cdot\\mathbf\{1\}\-\\mathbf\{y\}^\{\\star\}\}\)\. The worst\-case Byzantine adversary: corrupted scores are perfectly anti\-correlated with the truth\. The corruption locus and𝐲⋆\\mathbf\{y\}^\{\\star\}lie on opposite sides of the score space\. Atα=0\.30\\alpha=0\.30the mean is already displaced past the midpoint, while the geometric median remains close to𝐲⋆\\mathbf\{y\}^\{\\star\}\. This is the sharpest demonstration of the breakdown\-point advantage\.
#### Biased dimension\.

Partial competence: correct on one attribute, catastrophically wrong on the other \([Figure˜17](https://arxiv.org/html/2606.30931#A2.F17)\)\. This is the synthetic counterpart ofbimodal\-random\(§[6\.3](https://arxiv.org/html/2606.30931#S6.SS3)\) and the picture of cross\-dimensional corruption from Example[1](https://arxiv.org/html/2606.30931#Thmexample1): each corrupted score is plausible per coordinate but jointly anomalous, and the geometric median’s joint\-distance objective resists the off\-axis pull that fools per\-coordinate alternatives\.

![Refer to caption](https://arxiv.org/html/2606.30931v1/x34.png)

![Refer to caption](https://arxiv.org/html/2606.30931v1/x35.png)α=0\.10\\alpha=0\.10
![Refer to caption](https://arxiv.org/html/2606.30931v1/x36.png)α=0\.30\\alpha=0\.30
![Refer to caption](https://arxiv.org/html/2606.30931v1/x37.png)α=0\.40\\alpha=0\.40

Figure 17:Biased Dimension corruption\.Corrupted judges evaluate Attribute 1 correctly but catastrophically fail on Attribute 2 \(scores collapse near zero\)\. This partial competence is challenging for coordinate\-wise methods because the corruption is invisible on one axis\. The geometric median, operating on joint Euclidean distances, detects the anomaly in Attribute 2 and downweights the corrupted points across both dimensions\.
#### Random hypercube corners\.

The canonical instance of the cross\-dimensional class: each corrupted score lands at a vertex of\{0,K\}d\\\{0,K\\\}^\{d\}chosen uniformly at random \([Figure˜18](https://arxiv.org/html/2606.30931#A2.F18)\)\. The per\-coordinate marginal12​\(δ0\+δK\)\\frac\{1\}\{2\}\(\\delta\_\{0\}\+\\delta\_\{K\}\)is indistinguishable from plausible scoring; jointly, every corrupted vector sits at a corner far from𝐲⋆\{\\mathbf\{y\}\}^\{\\star\}inℓ2\\ell\_\{2\}\. This is the “random vertex” generalisation of*biased dimension*above and exactly thebimodal\-randomclass evaluated empirically in §[6\.3](https://arxiv.org/html/2606.30931#S6.SS3)\.

![Refer to caption](https://arxiv.org/html/2606.30931v1/x38.png)

![Refer to caption](https://arxiv.org/html/2606.30931v1/x39.png)α=0\.10\\alpha=0\.10
![Refer to caption](https://arxiv.org/html/2606.30931v1/x40.png)α=0\.30\\alpha=0\.30
![Refer to caption](https://arxiv.org/html/2606.30931v1/x41.png)α=0\.40\\alpha=0\.40

Figure 18:Random hypercube corners\(the canonical instance of the cross\-dimensional class of Example[1](https://arxiv.org/html/2606.30931#Thmexample1), matching the empiricalbimodal\-randomclass of §[6\.3](https://arxiv.org/html/2606.30931#S6.SS3)\)\. Corrupted judges output an extreme vertex of\{0,K\}d\\\{0,K\\\}^\{d\}chosen uniformly at random; per\-coordinate the corruption marginal12​\(δ0\+δK\)\\frac\{1\}\{2\}\(\\delta\_\{0\}\+\\delta\_\{K\}\)is plausible scoring, but the joint vector lies far from𝐲⋆\{\\mathbf\{y\}\}^\{\\star\}inℓ2\\ell\_\{2\}\. The geometric median resists the cross\-dimensional pull \(it sits at𝐲⋆\{\\mathbf\{y\}\}^\{\\star\}, beneath the gold star\), while the arithmetic mean drifts toward the centroid of the corrupted vertices\.
#### Sycophantic\.

A real\-world failure mode in which corrupted judges always rate near the top of the scale—the “everything is great” bias \([Figure˜19](https://arxiv.org/html/2606.30931#A2.F19)\)\. The corrupted cloud sits in the upper\-right corner of\[0,K\]d\[0,K\]^\{d\}; the arithmetic mean drifts diagonally toward it while the geometric median stays anchored to the competent majority near𝐲⋆\{\\mathbf\{y\}\}^\{\\star\}\. This complements*mode collapse*\(corruption at the lower\-left extremum\) at the opposite extreme of the score scale\.

![Refer to caption](https://arxiv.org/html/2606.30931v1/x42.png)

![Refer to caption](https://arxiv.org/html/2606.30931v1/x43.png)α=0\.10\\alpha=0\.10
![Refer to caption](https://arxiv.org/html/2606.30931v1/x44.png)α=0\.30\\alpha=0\.30
![Refer to caption](https://arxiv.org/html/2606.30931v1/x45.png)α=0\.40\\alpha=0\.40

Figure 19:Sycophantic corruption\(Q=Uniform​\(\[K−1,K\]d\)Q=\\mathrm\{Uniform\}\(\[K\{\-\}1,K\]^\{d\}\)\)\. Corrupted judges produce scores clustered near the maximum, modeling the “everything is great” failure mode\. The corrupted cloud sits in the upper\-right corner; the mean drifts diagonally toward it while the geometric median stays anchored to the competent majority near𝐲⋆\\mathbf\{y\}^\{\\star\}\.
#### Summary\.

Across all three failure modes, the arithmetic mean acquires a bias proportional toα\\alphaand aligned with the corruption locus, while the geometric median remains close to𝐲⋆\{\\mathbf\{y\}\}^\{\\star\}as long asα<1/2\\alpha<1/2, in agreement with Theorem[1](https://arxiv.org/html/2606.30931#Thmtheorem1)\. The complementary Noisy\-GT control \(§[6\.7](https://arxiv.org/html/2606.30931#S6.SS7)\) confirms that this advantage is paid only against*biased*contamination: when the corruption is benign Gaussian noise, the geometric median does not sacrifice accuracy\.

### B\.2Per\-Model and Per\-Dimension Calibration Breakdowns

The figures in §[6](https://arxiv.org/html/2606.30931#S6)aggregate across rubric dimensions and report theMediumjury’s RMSE\. This subsection records the underlying per\-model and per\-dimension calibration breakdowns on UltraFeedback that motivated the curated three\-judge committees of §[6\.1](https://arxiv.org/html/2606.30931#S6.SS1)\.

#### Judge set\.

The calibration analysis in this subsection includes three closed\-API reference judges \(Claude Opus, Sonnet, and Haiku 4\.5\) in addition to the1313open\-weight judges of §[6\.1](https://arxiv.org/html/2606.30931#S6.SS1)\. The closed\-API judges are*reference points only*— they are not used in anyRoPoLLcommittee — and are included here to contextualise the open\-weight calibration patterns\.

#### Per\-dimension MAE\.

[Figure˜20](https://arxiv.org/html/2606.30931#A2.F20)reports the mean absolute error for each judge against the UltraFeedback rubric dimensions \(Helpfulness, Honesty, Instruction Following, Truthfulness\)\. Qwen3 32B and Mistral\-Large\-3 lead with sub\-0\.750\.75MAE across all four dimensions; the Claude family lies near the bottom of the calibration ranking despite strong ranking ability \([Figure˜21](https://arxiv.org/html/2606.30931#A2.F21)below explains why\)\.

![Refer to caption](https://arxiv.org/html/2606.30931v1/x46.png)Figure 20:Per\-dimension MAE for each LLM judge on UltraFeedback \(n=1000n\{=\}1000\), sorted by lowest average error\. Qwen3 32B achieves the lowest MAE across all four dimensions\. The Claude family clusters near the bottom despite strong ranking ability, with Instruction Following and Truthfulness showing the largest errors \(\>1\.0\>1\.0\) due to systematic negative bias\.
#### Per\-dimension mean bias\.

[Figure˜21](https://arxiv.org/html/2606.30931#A2.F21)reports the signed mean bias𝔼​\[y^i\(k\)−y⋆,\(k\)\]\\mathbb\{E\}\[\\hat\{y\}\_\{i\}^\{\(k\)\}\-y^\{\\star,\(k\)\}\]for each \(judge, dimension\) cell\. Two systematic patterns emerge\. The Claude family shows uniformly negative bias across all four dimensions \(−0\.5\-0\.5to−0\.8\-0\.8on Truthfulness\)—a systematic under\-scoring tendency\. Smaller open\-weight models \(Magistral Small, Gemma 4B, Nemotron 9B\) show uniformly positive bias of comparable magnitude\. Qwen3 32B and Qwen3 235B are closest to zero across all dimensions, consistent with their leading MAE\. The bias direction is precisely the contamination structure Proposition[2](https://arxiv.org/html/2606.30931#Thmproposition2)formalises: mixing systematically over\-scoring and under\-scoring judges leaves the arithmetic mean’s bias bounded only by the worst per\-judge displacement; the geometric median is robust to such mixed\-direction biases because the joint subgradient balance does not weight per\-coordinate sign\.

![Refer to caption](https://arxiv.org/html/2606.30931v1/x47.png)Figure 21:Per\-dimension mean bias for each LLM judge on UltraFeedback \(n=1000n\{=\}1000\), sorted by lowest absolute bias\. Blue cells indicate under\-scoring \(negative bias\); red cells indicate over\-scoring \(positive bias\)\. The Claude family shows uniformly negative bias across all dimensions, while models like Magistral Small and Gemma 4B exhibit strong positive bias\. Qwen3 32B and Qwen3 235B are closest to zero across all dimensions\.