Budgeted Attack Scheduling for LLM Red-Teaming: The Roles of Static Priors, Semantic Guidance, and Online Feedback
As jailbreak attacks against large language models (LLMs) become increasingly diverse, red-teaming has come to rely on large libraries of jailbreak prompts and attack strategies to evaluate the robustness of victim models and their defense settings.
ProofPaper ↗
Key points
- However, attack effectiveness is highly condition-dependent: an attack that succeeds under one victim-defense setting may fail under another, while exhaustively evaluating the full attack library for each setting incurs substantial token and monetary costs.
- In this work, we formalize this problem as budgeted attack scheduling over a fixed attack library and investigate three complementary signals under a fixed victim-defense condition: (1) static historical attack success rate (ASR) priors; (2) semantic guidance from LLMs; and (3) online feedback from earlier queries.
- Building on these signals, we design four scheduling strategies and evaluate them across three victim models and three defense settings on GPT-5.2.
- Taken together, these findings characterize budgeted red-teaming as an attack scheduling problem in which historical priors, semantic guidance, and online feedback play complementary roles.
Sources (1)
- [1]Budgeted Attack Scheduling for LLM Red-Teaming: The Roles of Static Priors, Semantic Guidance, and Online FeedbackarXiv (AI, ML, NLP, CV, robotics, multi-agent) · Oct 19, 06:54 AM
As jailbreak attacks against large language models (LLMs) become increasingly diverse, red-teaming has come to rely on large libraries of jailbreak prompts and attack strategies to evaluate the robustness of victim models and their defense settings.
However, attack effectiveness is highly condition-dependent: an attack that succeeds under one victim-defense setting may fail under another, while exhaustively evaluating the full attack library for each setting incurs substantial token and monetary costs.
Extractive summary: sentences quoted from the sources.
Before this
- Oct 19, 2026PFedQFT: Personalized Federated Quantum-Inspired Fine-Tuning for Medical Large Language Models
- Oct 17, 2026How Well Can LLMs Verbalize Mathematical Formulas? A Multi-Domain Evaluation
- Oct 17, 2026A Cross-Domain Evaluation of Prompting Techniques for Large Language Models
- Oct 17, 2026Refuse the Harm, Complete the Task via Graph-of-Rules Planning for LLM-Enabled Robots
- Oct 16, 2026"You" Is Not Toxic: How LLM Labelers Rewrite the Web's Conversation Laws
- Oct 16, 2026Characterising and Analysing Retrieval-Augmented Generation Techniques