Paper compares budgeted scheduling for LLM jailbreak red-teaming
Original title: Budgeted Attack Scheduling for LLM Red-Teaming: The Roles of Static Priors, Semantic Guidance, and Online Feedback
Historical success priors, semantic guidance, and online feedback were tested across three models and three defenses on GPT-5.2.
An arXiv paper formalizes prioritizing a fixed jailbreak library under a limited attempt budget so red teams need not exhaust every attack for each victim and defense. It compares historical attack success-rate priors, semantic guidance from LLMs, and online feedback, then designs four scheduling strategies. Experiments cover three victim models and three defense settings on GPT-5.2. Priors initialize well but degrade under defense shifts; semantic guidance helps cold starts, and online feedback helps when priors are stale.
Unconfirmed: Only GPT-5.2 is named; the other victim models and defense settings are not identified in the abstract.
- Semantic guidance matched or beat static priors in the cold-start regime.
- Online feedback is described as most useful when transferred priors become stale.
- Both signals can partly compensate for missing historical priors.
- The abstract does not name the other two victim models.
- AI models
- GPT-5.2
From the original article
1 min read at arxiv.orgAs jailbreak attacks against large language models (LLMs) become increasingly diverse, red-teaming has come to rely on large libraries of jailbreak prompts and attack strategies to evaluate the robustness of victim models and their defense settings.
By Zhicheng Fang · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.