arXiv cs.AI· Micha{\l} Burzy\'nski, Noah T. Rossi, Shomit Basu, Andy Arditi·· 14 小时前AI 评分38
通过模型课程发现越狱提示词：CoM 方法在 gemma-4-31b-it 与 gpt-oss-120b 上的评估
Discovering Jailbreaks via Curriculum of Models
AI 导读
研究者提出 Curriculum of Models（CoM），通过让调查模型依次对抗从易到难的多个目标模型修改版本，缓解安全训练目标几乎全部拒答导致的稀疏奖励问题。
正文 · 原文
Abstract:Automated jailbreak discovery aims to find prompts that elicit prohibited behaviors from safety-trained language models, helping developers identify vulnerabilities before deployment. One class of approaches uses reinforcement learning to train an investigator model to generate prompts that elicit a specified behavior from a target model. However, training directly against a safety-trained target is difficult because nearly all prompts are refused, leaving the investigator with a sparse reward signal. Prior work addresses this with the propensity bound (PRBO), a proxy reward estimated by sampling responses from a more compliant target, and then adjusting for how likely those responses would have been under the original target.
We introduce Curriculum of Models (CoM), an alternative method that trains the investigator against a sequence of modified versions of the target, progressing gradually from a version that readily exhibits the specified behavior to the original target. For jailbreak discovery, training begins against a target version that rarely refuses harmful requests, and advances to the next, harder version once the investigator reliably elicits the behavior from the current one.
We evaluate CoM on elicitation tasks involving CBRN materials, explosives, and illicit drugs, using two open-weight targets, gemma-4-31b-it and gpt-oss-120b. We compare against PRBO and direct training on the original target without a curriculum. When the investigator is trained to elicit a single behavior, CoM finds successful jailbreaks more reliably than either baseline. When trained on multiple behaviors simultaneously, the CoM-trained investigator can elicit held-out behaviors, though PRBO-trained investigators achieve higher success rates. Our results suggest that a simple curriculum over target models offers a promising approach for addressing sparse rewards in rare-behavior elicitation.
| Subjects: | Machine Learning (cs.LG); Artificial Intelligence (cs.AI) |
| Cite as: | arXiv:2610.38833 [cs.LG] |
| (or arXiv:2610.38833v1 [cs.LG] for this version) | |
| https://doi.org/10.48550/arXiv.2610.38833 arXiv-issued DOI via DataCite |
Submission history
From: Andy Arditi [view email]
[v1]
Wed, 28 Oct 2026 20:23:32 UTC (621 KB)
来源：arXiv cs.AI · arxiv.org