Red-Bandit: Test-Time Adaptation for LLM Red-Teaming via Bandit-Guided LoRA Experts

2025/10/08 by Ziakas, Christos, Loo, Nicholas, Jain, Nishita +1
#Computation and Language (cs.CL) #FOS: Computer and information sciences

paper · doi:10.48550/arxiv.2510.07239

Abstract

Automated red-teaming has emerged as a scalable approach for auditing Large Language Models (LLMs) prior to deployment, yet existing approaches lack mechanisms to efficiently adapt to model-specific vulnerabilities at inference. We introduce Red-Bandit, a red-teaming framework that adapts online to identify and exploit model failure modes under distinct attack styles (e.g., manipulation, slang). Red-Bandit post-trains a set of parameter-efficient LoRA experts, each specialized for a particular attack style, using reinforcement learning that rewards the generation of unsafe prompts via a rule-based safety model. At inference, a multi-armed bandit policy dynamically selects among these attack-style experts based on the target model's response safety, balancing exploration and exploitation. Red-Bandit achieves state-of-the-art results on AdvBench under sufficient exploration (ASR@10), while producing more human-readable prompts (lower perplexity). Moreover, Red-Bandit's bandit policy serves as a diagnostic tool for uncovering model-specific vulnerabilities by indicating which attack styles most effectively elicit unsafe behaviors.

Citations

• Qwen3 Technical Report
• Understanding R1-Zero-Like Training: A Critical Perspective
• Graph of Attacks with Pruning: Optimizing Stealthy Jailbreak Prompt Generation for Enhanced LLM Content Moderation
• OpenAI's Approach to External Red Teaming for AI Models and Systems
• DeepSeek-R1 incentivizes reasoning in LLMs through reinforcement learning
• Diverse and Effective Red Teaming with Auto-generated Rewards and Multi-step Reinforcement Learning
• Atoxia: Red-teaming Large Language Models with Target Toxic Answers
• Learning to (Learn at Test Time): RNNs with Expressive Hidden States
• Learning diverse attacks on large language models for robust red-teaming and safety tuning
• AdvPrompter: Fast Adaptive Adversarial Prompting for LLMs
• Mixture of LoRA Experts
• Curiosity-driven Red-teaming for Large Language Models
• Rainbow Teaming: Open-Ended Generation of Diverse Adversarial Prompts
• HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusal
• BioXP-0.5B: Explainable Medical-AI via RL-GRPO
• Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversations
• Tree of Attacks: Jailbreaking Black-Box LLMs Automatically
• Jailbreaking Black Box Large Language Models in Twenty Queries
• AutoDAN: Generating Stealthy Jailbreak Prompts on Aligned Large Language Models
• GPTFUZZER: Red Teaming Large Language Models with Auto-Generated Jailbreak Prompts
• GPT-4 Is Too Smart To Be Safe: Stealthy Chat with LLMs via Cipher
• Trustworthy LLMs: a Survey and Guideline for Evaluating Large Language Models' Alignment
• FLIRT: Feedback Loop In-context Red Teaming
• Universal and Transferable Adversarial Attacks on Aligned Language Models
• Llama 2: Open Foundation and Fine-Tuned Chat Models
• Jailbroken: How Does LLM Safety Training Fail?
• Judging LLM-as-a-Judge with MT-Bench and Chatbot Arena
• Rewarded soups: towards Pareto-optimal alignment by interpolating weights fine-tuned on diverse rewards
• HaluEval: A Large-Scale Hallucination Evaluation Benchmark for Large Language Models
• Automatically Auditing Large Language Models via Discrete Optimization
• Toolformer: Language Models Can Teach Themselves to Use Tools
• Affective Coherence Monitoring for Transformer-Based Language Models
• Measuring Progress on Scalable Oversight for Large Language Models
• Red Teaming Language Models to Reduce Harms: Methods, Scaling Behaviors, and Lessons Learned
• ToxiGen: A Large-Scale Machine-Generated Dataset for Adversarial and\n Implicit Hate Speech Detection
• Red Teaming Language Models with Language Models
• WebGPT: Browser-assisted question-answering with human feedback
• Learning Transferable Visual Models From Natural Language Supervision
• Texygen: A Benchmarking Platform for Text Generation Models
• Proximal Policy Optimization Algorithms
• Deep reinforcement learning from human preferences
• Outrageously Large Neural Networks: The Sparsely-Gated Mixture-of-Experts Layer

Related

• Automated Progressive Red Teaming
• MART: Improving LLM Safety with Multi-round Automatic Red-Teaming
• Text-Diffusion Red-Teaming of Large Language Models: Unveiling Harmful Behaviors with Proximity Constraints
• Learning diverse attacks on large language models for robust red-teaming and safety tuning
• Holistic Automated Red Teaming for Large Language Models through Top-Down Test Case Generation and Multi-turn Interaction