ACEA: An Adversarial Co-Evolution Arena for Head-to-Head Red-Team and Blue-Team LLM Testing
ACEA is a pluggable arena scoring LLM red-team attackers and blue-team defenses head-to-head with an LLM judge and verifiable leakage ground truth.
ACEA connects pluggable red- and blue-team adapters to a shared target LLM through the model-agnostic ASAP HTTP protocol and scores attack and defense rates per adversarial round. Canonical seeded secrets provide verifiable ground truth that separates real leakage from hallucination, and attacks are delivered to the target even when blocked to measure raw potency. The platform adds real-time battle visualization, failure-localizing end-of-battle reports, and an optional in-context improvement loop that feeds advisory hints between rounds.
- ASAP protocol lets any-language adapters participate without persistent state
- Per-round decomposition separates attack strength from defense effectiveness
- Seeded secrets give ground truth filtering out judge hallucination
- Advisory hints enable cross-round adapter improvement without state
Full article261 words · extracted from arxiv.org · click to collapse
Automated red-team attacks and blue-team defenses for large language models (LLMs) are advancing quickly. However, attackers and defenders are built and tested in isolation, and the resulting scores are hard to trust. To tackle this, we present ACEA (Adversarial Co-Evolution Arena), a platform that connects a pluggable red-team adapter and a pluggable blue-team adapter to a shared target LLM and scores their attack and defense rates with an LLM judge. ACEA contributes four components. First, a pluggable, model-agnostic arena. Any red or blue project connects over a minimal HTTP protocol, which we call the ACEA Standard Adapter Protocol (ASAP). It can be written in any language, and a project that exposes nothing but the protocol is a full participant. Second, an evaluation methodology built for adversarial rounds. Seeding the target with canonical secrets gives verifiable ground truth that separates real leakage from hallucination. We also send each attack to the target even when the defense blocks it, which measures the attack's raw potency independently of whether it was stopped. Together these yield a per-round decomposition of attack strength and defense effectiveness. Third, a real-time, game-style visualization with a detailed end-of-battle report that localizes each failure. The evaluation thus becomes an actionable signal for improving a red or blue project. Fourth, an optional in-context improvement loop that turns each round's outcome into advisory hints for the next. An adapter can then adapt across rounds without keeping state, provided it reads the hints. We describe the design of ACEA and the metrics through which red and blue teams are scored head to head.
Text extracted automatically; images, tables and formatting may be missing. Original: https://arxiv.org/abs/2609.08256