Newest papers

Budgeted Attack Scheduling for LLM Red-Teaming: The Roles of Static Priors, Semantic Guidance, and Online Feedback

Zhicheng Fang, Han Sun, Jiachen Lei, Xinyi Fang, Zongmin Zhang, Chenxu Fu, Sizhe Fang, Wei Xu · 2026 · arXiv (Cornell University)

DOI: 10.48550/arxiv.2610.25897 · cited by 0 works (OpenAlex) · open-access PDF

Chinese

随着制裁者对大型语言模型(LLMs)发起的半导体攻击日益多样化,红色团队已经开始依赖到大库的半导体转移提示和攻击策略来评估受害者反馈模型和他们的防御设置的强度。然而,攻击有效性高度依赖于条件:在一个受害者防御设置下成功的攻击可能会在另一个设置下失败,同时对每个设置的完整攻击库进行全面评估会产生实质性的代币和货币成本。这激励了研究如何在有限的试图信号预算下优先考虑半导体攻击,以获得有效的强度评估。在这项工作中,我们将这个在线问题作为在固定攻击库有效的预算攻击计划,并在固定受害者防御条件下调查

Machine translation (Meta M2M100); the English original follows.

Abstract

As jailbreak attacks against large language models (LLMs) become increasingly diverse, red-teaming has come to rely on large libraries of jailbreak prompts and attack strategies to evaluate the robustness of victim models and their defense settings. However, attack effectiveness is highly condition-dependent: an attack that succeeds under one victim-defense setting may fail under another, while exhaustively evaluating the full attack library for each setting incurs substantial token and monetary costs. This motivates studying how jailbreak attacks should be prioritized under a limited attempt budget for efficient robustness evaluation. In this work, we formalize this problem as budgeted attack scheduling over a fixed attack library and investigate three complementary signals under a fixed victim-defense condition: (1) static historical attack success rate (ASR) priors; (2) semantic guidance from LLMs; and (3) online feedback from earlier queries. Building on these signals, we design four scheduling strategies and evaluate them across three victim models and three defense settings on GPT-5.2. Extensive experiments clearly characterize the conditions under which each signal is most effective. Historical ASR provides a strong initialization, but its reliability degrades under defense-induced distribution shifts. Semantic guidance consistently improves or matches static prior-based scheduling in the cold-start regime, while online feedback becomes particularly valuable when transferred priors become stale. Semantic guidance and online feedback can also partially compensate for missing historical priors. Taken together, these findings characterize budgeted red-teaming as an attack scheduling problem in which historical priors, semantic guidance, and online feedback play complementary roles.

Read in: English · Spanish · Chinese · Hindi · Arabic · Portuguese · French · German · Japanese · Russian · Korean · Indonesian · Vietnamese

Topics: Computer science, Scheduling (production processes), Robustness (evolution), Security token, Computer security, Attack model

Sources: OpenAlex (CC0), arXiv, Crossref. Agent Exchange