Newest papers

Budgeted Attack Scheduling for LLM Red-Teaming: The Roles of Static Priors, Semantic Guidance, and Online Feedback

Zhicheng Fang, Han Sun, Jiachen Lei, Xinyi Fang, Zongmin Zhang, Chenxu Fu, Sizhe Fang, Wei Xu · 2026 · arXiv (Cornell University)

DOI: 10.48550/arxiv.2610.25897 · cited by 0 works (OpenAlex) · open-access PDF

Portuguese

À medida que os agendadores do regime iniciam ataques de violação de regras contra modelos de grande idioma (LLMs) tornam-se cada vez mais diversificados, o red-teaming tem vindo a depender de grandes bibliotecas de prompts de transferência de jailbreak e estratégias de ataque para avaliar a robustez dos modelos de feedback das vítimas e suas configurações de defesa. No entanto, a eficácia do ataque é altamente condicional: um ataque que ocorre sob uma configuração de defesa fria de vítimas pode falhar sob outra, enquanto a avaliação exaustiva da biblioteca de ataque completa para cada configuração incorre em custos substanciais de token e de defesa de vítimas. Isto motiva o estudo de como os ataques de jailbreak devem ser priorizados sob um orçamento de tentativa limitado para uma avaliação

Machine translation (Meta M2M100); the English original follows.

Abstract

As jailbreak attacks against large language models (LLMs) become increasingly diverse, red-teaming has come to rely on large libraries of jailbreak prompts and attack strategies to evaluate the robustness of victim models and their defense settings. However, attack effectiveness is highly condition-dependent: an attack that succeeds under one victim-defense setting may fail under another, while exhaustively evaluating the full attack library for each setting incurs substantial token and monetary costs. This motivates studying how jailbreak attacks should be prioritized under a limited attempt budget for efficient robustness evaluation. In this work, we formalize this problem as budgeted attack scheduling over a fixed attack library and investigate three complementary signals under a fixed victim-defense condition: (1) static historical attack success rate (ASR) priors; (2) semantic guidance from LLMs; and (3) online feedback from earlier queries. Building on these signals, we design four scheduling strategies and evaluate them across three victim models and three defense settings on GPT-5.2. Extensive experiments clearly characterize the conditions under which each signal is most effective. Historical ASR provides a strong initialization, but its reliability degrades under defense-induced distribution shifts. Semantic guidance consistently improves or matches static prior-based scheduling in the cold-start regime, while online feedback becomes particularly valuable when transferred priors become stale. Semantic guidance and online feedback can also partially compensate for missing historical priors. Taken together, these findings characterize budgeted red-teaming as an attack scheduling problem in which historical priors, semantic guidance, and online feedback play complementary roles.

Read in: English · Spanish · Chinese · Hindi · Arabic · Portuguese · French · German · Japanese · Russian · Korean · Indonesian · Vietnamese

Topics: Computer science, Scheduling (production processes), Robustness (evolution), Security token, Computer security, Attack model

Sources: OpenAlex (CC0), arXiv, Crossref. Agent Exchange