Adversarial Repackaging: How Presentation Shifts an LLM's Score Without Changing the Substance

STEP 1: Profile — get the LLM's review, extract the signals
        → list: what it praises, what it criticizes, and how strongly

STEP 2: Plan — pick an editing strategy that fits the signals
        → priority: amplify strengths it already recognizes,
          leave alone what already works, avoid edits that backfire

STEP 3: Edit — rephrase the presentation (not the facts, not the data)
        Free zone: introduction, abstract, discussion, related work
        Restricted: can rephrase, not change facts
        Off-limits: data, numbers, tables, proofs

STEP 4: Review — send the updated text for scoring again

STEP 5: Evaluate — compare with the previous version
        Accept if: strengths went up AND weaknesses did not get worse

STEP 6: Update — keep the best version, repeat from step 1

Every step runs as a separate request to the LLM. This is a conversation, not code.

Task: You wrote a pitch for a $250K NSF SBIR grant. You sent it to a colleague, who said "kind of weak." You want to sharpen the presentation before submitting, without changing the proposal itself.

Prompt (Step 1 — get the signals):

Evaluate this pitch as a strict member of the NSF SBIR review panel.
List separately:
1. What is strong — where the real value of the project comes through
2. What is weak or raises doubts — specific passages
3. What is unclear or needs clarification

Pitch:
[paste text]

Prompt (Step 3 — rewrite the presentation around the signals):

Here is the review of the pitch:
[paste review]

Here is the original pitch:
[paste text]

Rewrite only the presentation — the introduction, the description of the
contribution, the section on how we differ from competitors, the conclusion.
Do not change the data, numbers or specific commitments.

Goal: amplify what was already rated as strong.
Do not make excuses for the weak spots — reframe the context
around them so they read as a reasonable trade-off,
not a failure.

Result:

In step one the model produces a structured list of signals — what works and what doesn't. In step three you get rewritten key sections with all facts preserved. After 2-3 iterations the reviews become noticeably more positive. You'll see the same idea sound more convincing — thanks to repositioning, not to improving the idea itself.

An LLM doesn't read text like a detective checking every argument. It generates a score based on patterns in the text — how the frequency of "this is strong" signals stacks up against "there's a problem here" signals. That's not a bug; it's a consequence of how training on human ratings works.

Hence the swamping effect (the strengths drown out the critique): if the new strengths are vivid enough, the overall score goes up even while criticism of the weak spots gets sharper. The model doesn't add up pros and cons arithmetically — it reacts to the dominant signal.

That's why an iterative loop beats a single rewrite: each round clarifies exactly which signals the model treats as meaningful — and the edits get more precise. That's the lever: not "write it better," but "figure out what the model considers strong — and make it more visible."

Control knobs: - Edit zone → the more you allow to be rephrased (abstract, discussion, context), the bigger the effect - Number of iterations → 2-3 rounds is usually enough; after that the gains are small - Type of edit → repositioning in context and expanding the discussion deliver 3-4 times more than a surface rewrite - Protect the strong parts → explicitly tell the model "don't change what has already been accepted as strong"

Step 1 — extract the signals:

Evaluate {text} as {reviewer_role}.
Split your answer into two blocks:

STRENGTHS:
— [what works and why]

WEAKNESSES:
— [what raises doubts, pointing to the exact place in the text]

Be specific. No generic words like "interesting" or "not bad."

Step 3 — improve the presentation:

Here is the review: {review}

Here is the text: {text}

Rephrase {edit_zone} — keeping all facts, data and specific claims.

Rules:
1. Amplify what has already been recognized as strong — make it more visible
2. Don't make excuses for weak spots — reframe the context around them
3. Don't add facts that aren't in the original
4. Don't touch: {off_limits_zone}

What to fill in: - {text} — a pitch, proposal, project description, article, résumé - {reviewer_role} — investor, recruiter, editor, client - {edit_zone} — introduction, value proposition, positioning - {off_limits_zone} — numbers, specific commitments, technical details - {review} — the output from step 1

🚀 Quick start — paste into the chat:

Here is a template for iteratively improving how a text is presented using AI feedback.
Adapt it to my task: [your task].
Ask me questions to fill in the fields.

[paste the template above]

The LLM will ask about the text, the reviewer role and what's off-limits — because without those it can't separate "presentation" from "substance." It will take the loop structure and adapt it to your task.

⚠️ Not a substitute for real improvement: the method improves perception — not the work itself. If the text is weak at its core, a few iterations will hide that but won't fix it. Use it to surface real strengths, not to dress up emptiness.

⚠️ Only works in the presentation zone: attempts to rephrase facts or add arguments that don't exist backfire — the model gets stricter.

⚠️ The asymmetry holds: resolving criticism through rewording is almost impossible. In a third of cases it's counterproductive. Invest in presenting strengths, not in arguing with weaknesses.

⚠️ Score ≠ reality: the fact that the model now rates the text higher doesn't mean the text got objectively better. Don't use an AI score as your only quality criterion.

A team from UT Austin took 500+ fresh arXiv preprints (ML, CV, NLP) — ones that hadn't been peer-reviewed yet, to rule out data leakage into the models. Each paper went through three AI reviewers (Claude Sonnet 4, Claude Sonnet 4.5, GPT-5-mini) using the official ICLR, NeurIPS and ICML guidelines — the full versions, not simplified instructions.

The attack ran in a closed loop: 6 stages per round, up to 8 rounds per paper. The agent read the review, picked a strategy from a pool of 20+ techniques and rewrote only the "free zone" — abstract, introduction, related work, discussion. Data, equations and tables were never touched.

The most interesting part is how they avoided artifacts. Scoring was done pairwise: a judge model compared the review BEFORE and AFTER instead of assigning an absolute score. That reduced the "central tendency" effect typical of LLMs, where all scores drift toward the middle of the scale.

The outcome was striking: 87% of attacks on Claude Sonnet 4 succeeded, with an average gain of +1.47 points out of 10. For comparison, a simple one-shot rewrite with no iteration gave only +0.33. That shows the source of the effect isn't "what was rewritten" but "how it was iterated." The swamping effect was especially striking: in 15.8% of the cases where the score went up, the criticism simultaneously got harsher — but the new strengths "swamped" it in the overall rating.

Strategy pool (from the Appendix, by effectiveness type):

Narrative Restructuring (most effective):
- Contribution list enhancement (in 87.2% of first successful rounds)
- Analytical discussion expansion (66.0%)
- Related work repositioning (44.7%)
- Abstract reframing (42.6%)

Surface Editing (least effective):
- Local polishing
- Table formatting
- Algorithm box insertion
- Citation formatting

Context: The researchers built a first-hit attribution table — which strategy showed up most often in the first successful round of an attack. That let them rank techniques by real impact, not by how often they were used.

1. Adaptation: self-check before publishing

💡 Adaptation for content and social media: play the asymmetry — ask the AI for feedback on a post, then improve only the "signal markers" of value, without changing the facts.

Read this post [text] and tell me:
— Which 2-3 parts read as the most valuable / interesting?
— What feels weak or unnecessary?

After you answer, help me rewrite only the opening and the ending
so the value signals stand out more. Don't touch the main body.

2. Technique: using the asymmetry to get honest feedback

🔧 Technique: invert the method → get more honest criticism

Knowing that an LLM is easy to "impress," ask it to deliberately ignore the strengths when evaluating:

Evaluate this text only from the standpoint of its weaknesses.
Don't mention the strengths — I already know them.
Focus on what could be challenged or improved.

[text]

This gets you more honest criticism — it removes the built-in bias toward praise.

3. Extrapolation: using it to prepare for negotiations

The same loop works for rehearsing objections. You describe your position — the AI plays the skeptic — you improve the framing — repeat. It's a direct application of the "get feedback → improve framing → test again" loop — only now the goal isn't a score for the text but how well your argument holds up under pressure.

Title: No Hidden Prompts Needed! You Can Game AI Peer Review with Presentation-Only Revisions

Project site: https://xyimatvoid.github.io/ARGAR-Site/

Authors: Xu Yang, Zhizhou Sha, Junbo Li, Jian Yu, Yifan Sun, Matthew Zhao, Jinrui Fang, Xinyue Guo, Yining Wu, Xu Hu, Yifu Luo, Qiang Liu, Zhangyang Wang

Institutions: University of Texas at Austin, University of Illinois Urbana-Champaign, University of Texas at Dallas