用不同角色模拟攻击，发现更真实多样的大模型漏洞。
Persona-Conditioned Adversarial Prompting: Multi-Identity Red-Teaming for Adversarial Discovery and Mitigation
- 以医生、学生等角色为条件生成攻击提示，模拟真实威胁场景。
- 在GPT-OSS 120B上攻击成功率从57%升至97%，提示多样性提升2-6倍。
- 生成数据可自动训练轻量适配器，显著提升模型安全防御能力。
自动化红队测试常局限于发现狭窄的攻击路径，难以覆盖多样化的现实威胁，且生成的数据不足以支撑安全微调。本文提出基于角色条件的对抗性提示（PCAP），通过设定不同攻击者角色（如医生、学生、恶意攻击者）及策略集，探索更真实的攻击场景。通过并行运行多种角色条件下的搜索，PCAP发现跨上下文可迁移的越狱攻击，并自动生成带有元数据追踪的丰富防御数据集。在GPT-OSS 120B上，攻击成功率由57%提升至97%，生成提示多样性提升2-6倍。关键的是，基于PCAP生成数据微调轻量级适配器后，模型鲁棒性显著增强（召回率：0.36 → 0.99，F1：0.53 → 0.96），且误报极少，验证了从漏洞发现到自动对齐的闭环可行性。
原文摘要 · Abstract (English)
Automated red-teaming for LLMs often discovers narrow attack slices, missing diverse real-world threats, and yielding insufficient data for safety fine-tuning. We introduce Persona-Conditioned Adversarial Prompting (PCAP), which conditions adversarial search on diverse attacker personas (e.g., doctors, students, malicious actors) and strategy sets to explore realistic attack scenarios. By running parallel persona-conditioned searches, PCAP discovers transferable jailbreaks across different contexts and generates rich defense datasets with automatic metadata tracking. On GPT-OSS 120B, PCAP increases attack success from 57\% to 97\% while producing 2-6$\times$ more diverse prompts covering varied real-world scenarios. Critically, fine-tuning lightweight adapters on PCAP-generated data significantly improves model robustness (recall: 0.36 $\rightarrow$ 0.99, F1: 0.53 $\rightarrow$ 0.96) with minimal false positives, demonstrating a practical closed-loop approach from vulnerability discovery to automated alignment.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。