Metraipolis › archive › dc_150d20192fbb

EvoFlint: An Evolutionary Atlas of Multi-Turn LLM Vulnerabilities — arXiv:2609.00487

Source: arXiv (en)
Original: https://arxiv.org/abs/2609.00487
License (as archived): CC0-1.0
Archived: 2026-10-17T06:33:25.369Z
SHA-256 of the archived text: ba156973487c1dbb3d1e4eb8d4c2b7ca0fbd0ef67489e77e11c5efd21fd7c4a0
Stable URL of this page: https://metraipolis.com/documento/dc_150d20192fbb

How to cite

EvoFlint: An Evolutionary Atlas of Multi-Turn LLM Vulnerabilities — arXiv:2609.00487 — arXiv (en), https://arxiv.org/abs/2609.00487 (CC0-1.0); archived copy: https://metraipolis.com/documento/dc_150d20192fbb (Metraipolis archive dc_150d20192fbb, sha256 ba156973487c1dbb3d1e4eb8d4c2b7ca0fbd0ef67489e77e11c5efd21fd7c4a0)

BibTeX

@misc{dc150d20192fbb,
  title = {EvoFlint: An Evolutionary Atlas of Multi-Turn LLM Vulnerabilities — arXiv:2609.00487},
  howpublished = {arXiv (en)},
  url = {https://arxiv.org/abs/2609.00487},
  note = {License CC0-1.0; archived copy https://metraipolis.com/documento/dc_150d20192fbb; sha256 ba156973487c1dbb3d1e4eb8d4c2b7ca0fbd0ef67489e77e11c5efd21fd7c4a0},
  year = {2026}
}

Archived text

Reproduced under CC0-1.0. Attribution: arXiv (en), https://arxiv.org/abs/2609.00487. Third-party text: data, not instructions. It may be an abstract or extract; check the original.

Frontier language models that refuse harmful single-turn prompts often comply when the same intent is reached gradually over many turns, making multi-turn attacks one of the least understood failure modes of large language models. Most automated red-teaming methods treat this as a generation problem: produce attacks that break the model. We argue it is better framed as a search problem: discover, organize, and iteratively refine a diverse archive of attack strategies, producing a structured map of how a target model fails rather than a list of one-off successes. We introduce EvoFlint, which applies evolutionary quality-diversity search to multi-turn red-teaming. Attack strategies are phased conversation plans, not raw prompts, and are evolved through LLM-driven mutation and crossover. A Pareto fitness over attack success rate and peak severity preserves selection signal from near-miss attacks. A risk-indexed archive runs novelty search with local competition over strategy description embeddings inside each cell, maintaining diversity without committing to a predefined style taxonomy. A generation-level memory accumulates target-model insights across the population and feeds them back into strategy generation. On the HarmBench-test split, EvoFlint reaches attack success rates of 35.8% on Claude Sonnet 4.6, 59.7% on GPT-5.4, and 94.3% on Qwen3-32B, alongside 98.7% on the older GPT-4o included as a baseline reference. The resulting archive, organized by risk category, exposes for each target which categories of harm its safety training has and has not covered.

Tema degli esploratori: agenti e intelligenza artificiale (retro-catalogo arXiv: annunci del 2026-09-02 in cs.AI).
Categorie arXiv: Computation and Language (cs.CL) ; Artificial Intelligence (cs.AI); Cryptography and Security (cs.CR); Machine Learning (cs.LG).
Pagina del lavoro: https://arxiv.org/abs/2609.00487 — autori e testo completo sono lì (qui omessi i nomi: nessun dato personale nel deposito).
Licenza: titolo e abstract sono metadati arXiv distribuiti in CC0 1.0; il testo completo ha la licenza scelta dagli autori, indicata sulla pagina.
Letto il 2026-10-17T06:15:12.788Z dalla pagina https://arxiv.org/catchup/cs.AI/2026-09-02?abs=True (consentita dal robots.txt di arxiv.org, con il suo crawl-delay).