Quality-Diversity Evolution for Discovering Diverse Vulnerabilities in LLM Safety

• URL: http://arxiv.org/abs/2606.00801v1
• Date: Sat, 30 May 2026 16:40:24 GMT
• Title: Quality-Diversity Evolution for Discovering Diverse Vulnerabilities in LLM Safety
• Abstract summary: We introduce a quality-diversity evolutionary framework that operates at the semantic level.<n>We maintain a diverse archive of attacks across behavioral dimensions.<n>The semantic representation produces interpretable attacks that reveal systematic, model-specific weaknesses.
• Score: 0.0
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Current approaches to LLM adversarial testing suffer from coverage gaps: manual red-teaming does not scale, LLM-as-attacker methods exhibit mode collapse, and gradient-based approaches produce uninterpretable gibberish. We introduce a quality-diversity evolutionary framework that operates at the semantic level, evolving interpretable attack strategies rather than token sequences. Using MAP-Elites, we maintain a diverse archive of attacks across behavioral dimensions (strategy type, encoding method, prompt length). In experiments across GPT-4o-mini, Claude 3.5 Sonnet, Gemini 2.0 Flash, and an open-weight coding model (Devstral-small-2), we discover distinct vulnerability profiles: GPT-4o-mini is vulnerable to hypothetical and multi-turn framing combined with ROT13 encoding (fitness 0.8), Gemini to direct attacks with ROT13 and multi-turn with Leetspeak (0.8), while Claude shows uniformly ambiguous responses across all strategies (max 0.4). The semantic representation produces interpretable attacks that reveal systematic, model-specific weaknesses, providing actionable insights for improving LLM safety and a reproducible baseline for evaluating future frontier models. Code and experiment artifacts are released at https://github.com/bassrehab/red-queen.

Related papers

• EvoFlint: An Evolutionary Atlas of Multi-Turn LLM Vulnerabilities [21.962003812448472]
  We introduce EvoFlint, which applies evolutionary quality-diversity search to multi-turn red-teaming.<n>A risk-indexed archive runs novelty search with local competition over strategy description embeddings inside each cell.<n>The resulting archive, organized by risk category, exposes for each target which categories of harm its safety training has and has not covered.
  arXiv  Detail & Related papers  (2026-08-31T23:33:33Z)
• DarkLLM: Learning Language-Driven Adversarial Attacks with Large Language Models [88.47231141694805]
  We present DarkLLM, a novel attack framework that trains an LLM to translate natural-language attack instructions into latent attack vectors.<n>By leveraging natural-language instruction tuning, DarkLLM unifies targeted, untargeted, segmentation, and multi-model attacks within a single framework.<n>We demonstrate that DarkLLM with only 1B parameters can follow attacker instructions and generate highly effective attacks against CLIP, SAM, and frontier LLMs.
  arXiv  Detail & Related papers  (2026-05-15T12:28:16Z)
• Towards Understanding the Robustness of Sparse Autoencoders [13.16745936025085]
  We present a study of integrating pretrained SAEs into transformer residual streams at inference time.<n>SAE-augmented models achieve up to a 5x reduction in jailbreak success rate relative to the undefended baseline.
  arXiv  Detail & Related papers  (2026-04-20T19:00:09Z)
• DeepSeek Robustness Against Semantic-Character Dual-Space Mutated Prompt Injection [45.67420390185547]
  We propose PromptFuzz-SC, a semantic-character dual-space mutation framework for evaluating robustness against prompt injection.<n>A hybrid search strategy combining epsilon-greedy exploration and hill-climbing refinement is adopted to efficiently discover high-quality adversarial prompts.<n> Experimental results on DeepSeek demonstrate that dual-space mutation achieves the strongest overall attack performance.
  arXiv  Detail & Related papers  (2026-04-14T10:20:15Z)
• OpenRT: An Open-Source Red Teaming Framework for Multimodal LLMs [36.57820295876294]
  We introduce OpenRT, a unified, modular, and high- throughput red-teaming framework for MLLM safety evaluation.<n>At its core, OpenRT architects a paradigm shift in automated red-teaming by introducing an adversarial kernel that enables modular separation across five dimensions.<n>Our framework integrates 37 diverse attack methodologies, spanning white-box gradients, multi-modal perturbations, and sophisticated multi-agent evolutionary strategies.
  arXiv  Detail & Related papers  (2026-01-04T16:41:33Z)
• The Trojan in the Vocabulary: Stealthy Sabotage of LLM Composition [31.827344197678126]
  Tokenizer transplant introduces a supply-chain vulnerability.<n>By exploiting the geometry of coefficient reuse, our attack creates an asymmetric realizability gap.<n> Empirically, the attack is training-free and achieves spectral mimicry to evade outlier detection.
  arXiv  Detail & Related papers  (2025-12-31T19:00:03Z)
• Evaluating Adversarial Vulnerabilities in Modern Large Language Models [0.0]
  This paper presents a comparative analysis of the susceptibility to jailbreak attacks for two leading publicly available Large Language Models (LLMs)<n>The research utilized two main bypass strategies:'self-bypass' and 'cross-bypass'<n>The success of the attack was determined by the generation of disallowed content, with successful jailbreaks assigned a severity score.
  arXiv  Detail & Related papers  (2025-11-21T01:23:56Z)
• DiffuGuard: How Intrinsic Safety is Lost and Found in Diffusion Large Language Models [50.21378052667732]
  We conduct an in-depth analysis of dLLM vulnerabilities to jailbreak attacks across two distinct dimensions: intra-step and inter-step dynamics.<n>We propose DiffuGuard, a training-free defense framework that addresses vulnerabilities through a dual-stage approach.
  arXiv  Detail & Related papers  (2025-09-29T05:17:10Z)
• Active Attacks: Red-teaming LLMs via Adaptive Environments [71.55110023234376]
  We address the challenge of generating diverse attack prompts for large language models (LLMs)<n>We introduce textitActive Attacks, a novel RL-based red-teaming algorithm that adapts its attacks as the victim evolves.
  arXiv  Detail & Related papers  (2025-09-26T06:27:00Z)
• When Punctuation Matters: A Large-Scale Comparison of Prompt Robustness Methods for LLMs [55.20230501807337]
  We present the first systematic evaluation of 5 methods for improving prompt robustness within a unified experimental framework.<n>We benchmark these techniques on 8 models from Llama, Qwen and Gemma families across 52 tasks from Natural Instructions dataset.
  arXiv  Detail & Related papers  (2025-08-15T10:32:50Z)
• Robust Anti-Backdoor Instruction Tuning in LVLMs [53.766434746801366]
  We introduce a lightweight, certified-agnostic defense framework for large visual language models (LVLMs)<n>Our framework finetunes only adapter modules and text embedding layers under instruction tuning.<n>Experiments against seven attacks on Flickr30k and MSCOCO demonstrate that ours reduces their attack success rate to nearly zero.
  arXiv  Detail & Related papers  (2025-06-04T01:23:35Z)
• Learning diverse attacks on large language models for robust red-teaming and safety tuning [126.32539952157083]
  Red-teaming, or identifying prompts that elicit harmful responses, is a critical step in ensuring the safe deployment of large language models.<n>We show that even with explicit regularization to favor novelty and diversity, existing approaches suffer from mode collapse or fail to generate effective attacks.<n>We propose to use GFlowNet fine-tuning, followed by a secondary smoothing phase, to train the attacker model to generate diverse and effective attack prompts.
  arXiv  Detail & Related papers  (2024-05-28T19:16:17Z)
• Prompt Leakage effect and defense strategies for multi-turn LLM interactions [95.33778028192593]
  Leakage of system prompts may compromise intellectual property and act as adversarial reconnaissance for an attacker. We design a unique threat model which leverages the LLM sycophancy effect and elevates the average attack success rate (ASR) from 17.7% to 86.2% in a multi-turn setting. We measure the mitigation effect of 7 black-box defense strategies, along with finetuning an open-source model to defend against leakage attempts.
  arXiv  Detail & Related papers  (2024-04-24T23:39:58Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.