Are you sure it will not work for write just "subject"
?
I have the same problem, and I found use raw string worked.
Or maybe use like this also worked
CriteriaBuilder cb = em.getCriteriaBuilder();
CriteriaQuery<Exam> cq = cb.createQuery(Exam.class);
Root<Exam> root = cq.from(Exam.class);
cq.where(cb.isMember(subject, (ListAttribute)root.get(Exam_.subjects)));
return em.createQuery(cq);