| Challenge: | Large Language Model (LLM)-based agents are increasingly used in domains with strict policies, such as refund eligibility or cancellation rules. |
| Approach: | They propose a multi-agent red-teaming system that leverages policy-aware persuasive strategies to undermine a policy-adherence agent in a customer-service scenario. |
| Outcome: | The proposed model outperforms jailbreak methods and tau-break to assess agent's robustness against manipulative user behavior. |
Similar Papers
Agent vs. Agent: Automated Data Generation and Red-Teaming for Custom Agentic Workflows (2025.emnlp-industry)
Copied to clipboard
| Challenge: | Existing red-teaming frameworks like AgentHarm use static prompts and hardcoded toolsets . |
| Approach: | They propose a red-teaming framework that generates adversarial tasks and evaluation functions tailored to arbitrary toolsets and uses iterative prompt refinement with self-reflection to develop more effective attacks. |
| Outcome: | The proposed approach achieves 162% increase in attack success rate on o4-mini and 86% success on gemini 2.5 Pro. |
Stop Fixating on Prompts: Reasoning Hijacking and Constraint Tightening for Red-Teaming LLM Agents (2026.acl-long)
Copied to clipboard
| Challenge: | Existing red-team methods rely on modifying user prompts, which lack adaptability to new data and may impact the agent’s performance. |
| Approach: | They propose a framework that implicitly manipulates the agent’s reasoning trajectory and memory retrieval with three key stages: Trigger Extraction, Reasoning Hijacking, and Constraint Tightening. |
| Outcome: | The proposed framework shows outstanding performance in cross-model and cross-scenario environments. |
Automated Progressive Red Teaming (2025.coling-main)
Copied to clipboard
| Challenge: | Automated red teaming (ART) is effective but time-consuming, costly and lacks scalability. |
| Approach: | They propose an automated red teaming framework that generates adversarial prompts to expose LLM vulnerabilities. |
| Outcome: | The proposed framework explores and exploits LLM vulnerabilities through multi-round interactions. |
RedCoder: Automated Multi-Turn Red Teaming for Code LLMs (2026.acl-long)
Copied to clipboard
Wenjie Jacky Mo, Qin Liu, Xiaofei Wen, Dongwon Jung, Hadi Askari, Wenxuan Zhou, Zhe Zhao, Muhao Chen
| Challenge: | Existing red-teaming approaches for code generation rely on extensive human effort and are prone to generating malicious code under adversarial environments. |
| Approach: | They propose a red-teaming agent that engages victim models in multi-turn conversations to elicit vulnerable code. |
| Outcome: | Experiments show that RedCoder outperforms red-teaming methods in inducing vulnerabilities in code generation. |
Be Your Own Red Teamer: Safety Alignment via Self-Play and Reflective Experience Replay (2026.findings-acl)
Copied to clipboard
| Challenge: | Large Language Models (LLMs) have remarkable capabilities but are vulnerable to adversarial “jailbreak” attacks designed to bypass safety guardrails. |
| Approach: | They propose to empower a large language model to be its own red teamer . safety self-play allows the model to act as both the Attacker and Defender . |
| Outcome: | The proposed approach outperforms baselines trained on static adversarial datasets and establishes a new benchmark for proactive safety alignment. |
ARES: Adaptive Red-Teaming and End-to-End Repair of Policy-Reward System (2026.acl-long)
Copied to clipboard
Jiacheng Liang, Yao Ma, Tharindu Kumarage, Satyapriya Krishna, Rahul Gupta, Kai-Wei Chang, Aram Galstyan, Charith Peris
| Challenge: | Existing red-teaming approaches focus on policy-level weaknesses, but they overlook systemic weaknesses . aRES exploits dual-targeting weaknesses in both the core LLM and the RM simultaneously. |
| Approach: | a new framework uncovers weaknesses in both the core and the reward models simultaneously . a "Safety Mentor" generates semantically coherent adversarial prompts . |
| Outcome: | ARES uncovers weaknesses in both the core LLM and the RM simultaneously . it fine-tunes the LM to detect harmful content, then optimizes the core model . |
Adaptive Instruction Composition for Automated LLM Red-Teaming (2026.acl-long)
Copied to clipboard
| Challenge: | Adaptive instruction composition is a framework for red-teaming that combines crowdsourced texts with random combinations to optimize effectiveness and diversity. |
| Approach: | They propose a framework that combines crowdsourced texts according to an adaptive mechanism trained to optimize effectiveness with diversity. |
| Outcome: | The proposed framework outperforms random combination on effectiveness and diversity metrics even under model transfer. |
Agents Under Siege: Breaking Pragmatic Multi-Agent LLM Systems with Optimized Prompt Attacks (2025.acl-long)
Copied to clipboard
| Challenge: | Multi-agent LLMs are prone to adversarial attacks because of constraints such as limited token bandwidth and latency between message delivery. |
| Approach: | They propose a permutation-invariant adversarial attack that optimizes prompt distribution across latency and bandwidth constraints to bypass distributed safety mechanisms within the system. |
| Outcome: | The proposed method outperforms conventional attacks by up to 7 on multiple models. |
Guardrails and Security for LLMs: Safe, Secure and Controllable Steering of LLM Applications (2025.acl-tutorials)
Copied to clipboard
Traian Rebedea, Leon Derczynski, Shaona Ghosh, Makesh Narsimhan Sreedhar, Faeze Brahman, Liwei Jiang, Bo Li, Yulia Tsvetkov, Christopher Parisien, Yejin Choi
| Challenge: | Pretrained generative models provide novel ways for users to interact with computers. |
| Approach: | This tutorial provides an overview of key guardrail mechanisms developed for LLMs along with evaluation methodologies and a detailed security assessment protocol. |
| Outcome: | This tutorial provides an overview of key guardrail mechanisms developed for LLMs, along with evaluation methodologies and a detailed security assessment protocol. |
Atoxia: Red-teaming Large Language Models with Target Toxic Answers (2025.findings-naacl)
Copied to clipboard
| Challenge: | Large language models (LLMs) are still vulnerable to generation safety vulnerabilities. |
| Approach: | They propose a method that A**tacks LLMs with target "toxi" given a particular harmful answer, the method generates a user query and a misleading answer opening to examine the internal defects of a given LLM. |
| Outcome: | The proposed method detects safety risks in open-source models and state-of-the-art models such as GPT-4o. |