arXiv cs.AI· Zhaorun Chen, Xun Liu, Mintong Kang, Jiawei Zhang, Minzhou Pan, Shuang Yang, Bo Li·· 11 小时前AI 评分45
ARMs：面向多模态模型的自适应红队智能体，支持即插即用攻击
ARMs: Adaptive Red-Teaming Agent against Multimodal Models with Plug-and-Play Attacks
AI 导读
研究者提出自适应红队智能体 ARMs，可针对视觉语言模型自动优化多样化攻击策略，在实例与策略基准上取得 SOTA 攻击成功率，平均超出基线 52.1%，在 Claude-4-Sonnet 上超过 90%。
正文 · 原文
Abstract:As vision-language models (VLMs) gain prominence, their multimodal interfaces also introduce new safety vulnerabilities, making the safety evaluation challenging and critical. Existing red-teaming efforts are either restricted to a narrow set of adversarial patterns or depend heavily on manual engineering, lacking scalable exploration of emerging real-world VLM vulnerabilities. To bridge this gap, we propose ARMs, an adaptive red-teaming agent that systematically conducts comprehensive risk assessments for VLMs. Given a target harmful behavior or risk definition, ARMs automatically optimizes diverse red-teaming strategies with reasoning-enhanced multi-step orchestration, to effectively elicit harmful outputs from target VLMs. We propose 11 novel multimodal attack strategies, covering diverse adversarial patterns of VLMs (e.g., reasoning hijacking, contextual cloaking), and integrate 17 red-teaming algorithms into ARMs via model context protocol (MCP). To balance the diversity and effectiveness of the attack, we design a layered memory with an epsilon-greedy attack exploration algorithm. Extensive experiments on instance- and policy-based benchmarks show that ARMs achieves SOTA attack success rates, exceeding baselines by an average of 52.1% and surpassing 90% on Claude-4-Sonnet. We show that the diversity of red-teaming instances generated by ARMs is significantly higher, revealing emerging vulnerabilities in VLMs. Leveraging ARMs, we construct ARMs-Bench, a large-scale multimodal safety dataset comprising over 30K red-teaming instances spanning 51 diverse risk categories, grounded in both real-world multimodal threats and regulatory risks. Safety fine-tuning with ARMs-Bench substantially improves the robustness of VLMs while preserving their general utility, providing actionable guidance to improve multimodal safety alignment against emerging threats.
| Comments: | Accepted to ICLR 2026. Distinguished Paper Award at the CVPR 2026 AdvML Workshop. 64 pages, 16 figures. Project page: this https URL |
| Subjects: | Artificial Intelligence (cs.AI); Machine Learning (cs.LG) |
| Cite as: | arXiv:2510.02677 [cs.AI] |
| (or arXiv:2510.02677v2 [cs.AI] for this version) | |
| https://doi.org/10.48550/arXiv.2510.02677 arXiv-issued DOI via DataCite |
|
| Journal reference: | The Fourteenth International Conference on Learning Representations (ICLR 2026) |
Submission history
From: Xun Liu [view email]
[v1]
Fri, 3 Oct 2025 02:28:02 UTC (12,674 KB)
[v2]
Wed, 4 Nov 2026 22:56:01 UTC (12,674 KB)
来源：arXiv cs.AI · arxiv.org