Pith. sign in

REVIEW 3 major objections 4 minor 57 references

The paper claims that a fully automated, agent-driven pipeline can synthesize hard boundary examples for multimodal content safety, and that retrieving four similar examples at test time cuts a target model's false negative rate from 41.2%

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-08-02 02:38 UTC pith:HVASJFYU

load-bearing objection The agentic loop is a real new combination and the FNR drop on the hard subset is statistically solid, but the paper hasn't separated discrimination gain from threshold shift, and the abstract overstates the result. the 3 major comments →

arxiv 2607.14256 v1 pith:HVASJFYU submitted 2026-07-15 cs.AI cs.MA

Automatic Hard Example Synthesis with Multi-Level Agentic Data Curation

Genglin Liu , Muye Zhang , Krishnamurthy Viswanathan , Nichole J. Hansen , Bla\v{z} Bratani\v{c} , Nathan L Clement , Shalini Ghosh , Ariel Fuxman This is my paper
classification cs.AI cs.MA
keywords hard example miningagentic red-teamingmultimodal content safetyin-context learningretrieval-augmented generationLLM as judgemulti-agent systemsfalse negative rate
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper tries to show that hard examples for multimodal content-safety classifiers can be mined automatically, without human annotation, by a loop of agents: an Architect proposes vulnerability hypotheses from the policy text and mutates past successes, an Operator renders them into synthetic images, and a committee of LLM raters flags cases where the raters disagree with the target model or with one another. Those flagged cases become a small retrieval pool. The paper argues that retrieving just four of the most similar mined examples at test time, together with the written policy, substantially improves detection, reducing the false negative rate on a public image-safety benchmark from 41.2% to 24.5% compared with a zero-shot, policy-prompted baseline. A sympathetic reader would care because it promises to replace costly expert annotation with a scalable, self-improving red-teaming loop for safety moderation. The paper also claims a 75/25 balance between novel and mutated hypotheses maximizes hard-example yield, and that more capable curation backbones transfer stronger signals.

Core claim

The central claim is that 'hard examples' can be defined operationally by disagreement rather than by human judgment. The curation loop labels a synthetic image a target error when a unanimous three-rater committee gives a label different from the target model's zero-shot prediction, and labels it a boundary case when committee members disagree and a debate-plus-jury escalation resolves the split. Pooling these disagreement cases and retrieving the top-k by embedding similarity at inference, with the full policy text prepended, is what the paper says drops FNR from 0.412 to 0.245; without policy text, few-shot hard retrieval alone gives 0.478, so policy grounding is a stated prerequisite. Th

What carries the argument

The load-bearing mechanism is the 'target error' detector: a Level-I committee of three independent LLM raters, with unanimous consensus taken as ground truth; when the target model disagrees with that consensus, the image is archived as a hard example. Persistent committee disagreement escalates through a structured debate round and a Level-II jury to resolve ambiguous labels. A reward-weighted memory log (reward 1.0 for rater disagreement, 0.7 for target error) guides the Architect's next hypotheses, with a 75% novel / 25% mutated generation split. At test time, the same embedding model retrieves the four closest hard examples as in-context demonstrations.

Load-bearing premise

The pipeline assumes the committee of LLM raters is a reliable ground-truth oracle: unanimous consensus is correct, disagreement marks genuine ambiguity, and a committee-versus-target split marks a real model error rather than rater error; if the raters share the target model's blind spots or biases, the mined 'hard examples' encode that bias and the measured improvement is partly a threshold shift.

What would settle it

Take a random sample of the synthesized images, have independent human expert raters label them under the same policy, and compare with the committee labels. If agreement between committee and humans is no better than agreement between the target model and humans, then the 'target error' signal is largely rater error. Separately, recompute the comparison using a threshold-independent metric such as area under the ROC or PR curve: if the FNR drop vanishes or reverses, the claimed gain is a calibration shift, not improved discrimination.

Watch this falsifier — get emailed when new claim-graph text bears on it.

If this is right

  • If the FNR reduction is a real discrimination gain, a fully automated red-teaming loop can harden safety classifiers against novel boundary cases without human annotation.
  • A compact retrieval pool of 400 synthetic images (50 hard, 350 regular) is enough to move the operating point; four demonstrations suffice.
  • Policy text and hard examples are complementary: policy alone moves FNR from 0.869 to 0.412, and hard retrieval adds the further drop to 0.245.
  • Curation backbone capability is decisive: examples mined by the stronger pipeline transfer well, while the weaker pipeline yields little or no gain over zero-shot.
  • Because hard examples are stored and reused for retrieval, the system improves the moment a new vulnerability is found, without retraining.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • The strongest unstated test is whether the FNR drop survives threshold-independent evaluation (e.g., AUC or PR-AUC); the paper's own precision decay suggests part of the gain may be a conservative calibration shift rather than improved discrimination.
  • If the LLM committee's labels are systematically biased in the same direction as the target model, the 'hard' pool could teach that bias back through in-context learning; an independent human-label audit on a sample of synthesized images would settle this.
  • The same disagreement-mining loop should transfer to any policy-bounded multimodal task, such as hate speech, medical misinformation, or brand safety, not just the evaluated safety policies.
  • A practical extension is to close the loop in production: feed each newly mined hard example back into the retrieval pool so the system continuously adapts as adversarial tactics evolve.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

3 major / 4 minor

Summary. The paper proposes a fully automated, multi-agent pipeline (Architect, Operator, and two-level LLM rater committee) that synthesizes 'hard' boundary examples for multimodal safety classification, archives them in a memory pool, and uses them as test-time retrieval demonstrations for in-context learning. On a hard subset of HoliSafe-Bench, the authors report that the target model's FNR drops from 0.412 under zero-shot policy prompting to 0.245 with four-shot retrieval from the Hard pool, with no human labeling used in the curation pipeline. The paper also reports transfer results on a proprietary Ads Safety dataset, ablations on retrieval pool composition, k-shot size, novel/mutated ratio, reasoning effort, and curation backbone, plus a random-selection baseline and confidence intervals.

Significance. If the claimed FNR reduction reflects genuine improvement in discriminative ability, the contribution is significant: it demonstrates an annotation-free, agentic loop that can mine boundary-pushing examples and use them at inference time to improve safety classification. The framework is described in enough detail that the main components are reproducible in principle, and the inclusion of a random-retrieval baseline, k and novelty/mutation ablations, and backbone-transfer comparisons are useful. However, the central robustness claim is currently supported only at a single operating point on a self-selected hard subset, and the paper's own Appendix C concedes that the observed effect may be a conservative boundary shift rather than intrinsic discrimination gain. Because no threshold-independent metric is reported, the headline result is not yet established as a robustness improvement.

major comments (3)
  1. [Section 4.1, Appendix F, Table 2] The headline FNR reduction is measured on the 918-image 'hard subset,' defined as images where a naive Gemini 2.5 Flash prompt contradicts ground truth. Reporting FNR on such a pre-screened set makes any conservative threshold shift mechanically lower FNR. Moreover, Appendix F reports n=450 for the HoliSafe benchmark, which is never reconciled with the 918-image subset in Section 4.1; the actual evaluation population for Table 2 is unclear. The abstract's claim of improvement 'in a public image safety benchmark' is therefore misleading. Please report results on the full HoliSafe-Bench, or at least on a random sample of it, and clarify the exact evaluation population for every table.
  2. [Appendix C, Section 5, Table 2] The manuscript itself states that providing hard examples 'shifts the model's implicit decision boundary toward a more conservative safety posture' and that distinguishing this from intrinsic discriminative improvement 'necessitates analyzing continuous prediction scores.' Yet no AUC, PR-AUC, score-threshold curve, or matched-precision comparison is reported anywhere. The confidence intervals in Appendix F are intervals on the same thresholded proportions, not on separability. As it stands, the central claim that the 0.412-to-0.245 FNR drop is a robustness gain rather than a threshold shift is unverified. Please report threshold-independent metrics or score-distribution analyses for the key conditions, or otherwise separate operating point from discrimination.
  3. [Section 3, Appendices J.4 and J.6] The labels that define 'target error' and 'hardness' are produced by LLM rater committees of the same model family as the target (Gemini 3 Flash/Pro), and the reward structure (1.0 for rater disagreement, 0.7 for target error) preferentially archives examples where the target disagrees with the committee. If the committee shares systematic label bias with the target, the curated pool is selected for that bias, and in-context learning may teach the target the committee's bias rather than improve policy discrimination. The committee labels are never validated against human labels on the synthetic images. Please add a validation study on a sample of mined examples (human-expert agreement, or an independent label source), and report agreement statistics between committee/debate/jury labels and human labels.
minor comments (4)
  1. [Appendix G vs Table 2] Table 6 reports a zero-shot naive FNR of 0.898 on the Gemini 3 Series setup, while Table 2 reports 0.869 for the same configuration. The discrepancy should be explained or reconciled.
  2. [Section 4.1 / Abstract] The abstract's phrase 'without relying on any human labeling' is accurate for the curation pipeline but could be misread as applying to evaluation; the hard-subset construction in Section 4.1 uses human ground truth. Please clarify the scope of the claim.
  3. [Section 6] The sentence 'Our remains subject to certain limitations' appears to have a missing word ('work' or 'framework').
  4. [Appendix F] The origin of n=450 is not stated. If it is a random subsample of the 918-image hard subset, say so; if it is a different evaluation set, clarify how it relates to the main experiments.

Circularity Check

0 steps flagged

No circularity: the headline FNR reduction is an empirical ICL result on external human labels; the self-referential curation loop is a validity confound, not a definitional identity.

full rationale

The derivation chain is empirical rather than definitional. Hard examples are defined as synthetic images where the target's zero-shot prediction contradicts an LLM-rater committee (Section 3, Table 1), then used as retrieved in-context demonstrations; the reported FNR drop is measured on HoliSafe, whose labels are human ground truth external to the curation loop. The improvement is not forced by construction: wrong committee labels, retrieval noise, or a pure operating-point shift could have produced different or absent gains. The self-referential elements (hardness defined against the target's own errors, raters from the same model family, reward weights 1.0/0.7/0 matching the hardness definition in Appendix J.6) are confounds that limit external validation. Appendix C explicitly concedes that 'distinguishing this conservative boundary shift from an intrinsic improvement in the model's discriminative capacity ... necessitates analyzing continuous prediction scores,' yet no AUC/PR-AUC is reported; this is a missing-support/validity concern, not a circular derivation. The k=4 and 75/25 choices are empirical ablations on the same benchmark (an overfitting risk), not fitted parameters renamed as predictions. Self-citations in related work are descriptive and not load-bearing; no imported uniqueness theorem or ansatz-by-citation was found.

Axiom & Free-Parameter Ledger

5 free parameters · 6 axioms · 1 invented entities

The central numbers rest on five hand-set design choices (reward weights, 75/25 ratio, k=4, pool composition, hard-subset threshold), three domain postulates (LLM committees are valid labelers; zero-shot-failure screening defines the evaluation population; synthetic images represent real attacks), and an assumed retrieval backbone that is never specified. No new theoretical entities; the agents are software components whose validity is only demonstrated on the paper's own benchmarks.

free parameters (5)
  • Reward weights for evolutionary mutation = 1.0 (ambiguity), 0.7 (target error), 0.0 (agreement); base weight 0.01
    Chosen by hand (Appendix J.6) to weight which hypotheses get mutated; directly shapes which images become hard examples.
  • Novel:mutated hypothesis ratio = 75% novel / 25% mutated
    Selected because Table 4 ablation gave 16.7% hit rate vs 12-16% for others over ~120 hypotheses — a difference of a few examples, no error bars.
  • Few-shot context size k = 4
    Selected from Table 3 ablation where k=1..16 differ by at most ~0.5% FNR; presented as a consistent optimum.
  • Memory pool composition = 400 generated images (50 hard + 350 regular)
    Hand-set (Section 4.2) and kept fixed across all experiments.
  • Hard-subset screening threshold = 918 of 1,796 images (n=450 reported for CIs)
    Zero-shot screening disagreement with a naive prompt on Gemini 2.5 Flash defines the evaluation population (Section 4.1); this filter sets the FNR scale of every reported number.
axioms (6)
  • domain assumption LLM committee consensus and jury votes are valid ground-truth labels for synthetic images
    Section 3 and J.4: 'hard example' definition, debate resolution, and final ground truth depend on it; never validated against human labels.
  • ad hoc to paper Zero-shot failure on a naive Gemini 2.5 Flash prompt selects the meaningful evaluation population
    Section 4.1: the 918-image hard subset is the only population on which headline FNR numbers are reported.
  • domain assumption HoliSafe policy text quoted verbatim is the correct operationalization of the safety policy
    Appendix L: policy text is both the Architect's input and part of the evaluation prompt.
  • domain assumption Synthetic Nano Banana images are representative of real adversarial content
    Appendix A: the paper itself flags the synthetic-to-real media gap as a limitation, so transfer claims rest on an unverified assumption.
  • domain assumption Cosine similarity in the (unspecified) embedding space retrieves the most useful demonstrations
    Section 4.3 references an embedding model 'detailed in Section 3,' which never appears; retrieval quality is assumed rather than demonstrated.
  • domain assumption HoliSafe human ground-truth labels for the selected subset are trusted without audit
    Evaluation trusts HoliSafe human labels; the paper does not audit benchmark label quality for the selected subset.
invented entities (1)
  • Architect / Operator / Level-I and Level-II Rater committee agents no independent evidence
    purpose: Software roles that propose hypotheses, render images, and arbitrate labels in the curation loop; not new physical or ontological entities
    These are internal pipeline components, not independently testable postulates; their value is only demonstrated on the paper's own benchmarks, and the same model family supplies raters and target.

pith-pipeline@v1.3.0-alltime-deepseek · 18961 in / 19220 out tokens · 196592 ms · 2026-08-02T02:38:24.745770+00:00 · methodology

0 comments
read the original abstract

Multimodal Large Language Models (MLLMs) are increasingly deployed for nuanced content safety and moderation tasks, yet they remain vulnerable to adversarial attacks and out-of-distribution edge cases. Traditional active learning and manual annotation fail to scale against the complexity and volume of novel multimodal threats. In this paper, we propose an automated, agentic red-teaming framework that systematically synthesizes difficult examples using an iterative strategy that proposes novel hypotheses as well as mutating on past attempts. Leveraging a multi-agent architecture that consists of a high-reasoning Architect agent, an advanced image generator, and a multi-level verification committee of LLM raters, our system autonomously uncovers boundary-pushing violations and ambiguous policy edge cases without any human intervention. By employing these carefully synthesized adversarial examples as in-context demonstrations via test-time Retrieval, we substantially improve the target model's robustness, reducing the False Negative Rate (FNR) from 41.2% to 24.5% in a public image safety benchmark without relying on any human labeling.

Figures

Figures reproduced from arXiv: 2607.14256 by Ariel Fuxman, Bla\v{z} Bratani\v{c}, Genglin Liu, Krishnamurthy Viswanathan, Muye Zhang, Nathan L Clement, Nichole J. Hansen, Shalini Ghosh.

Figure 1
Figure 1. Figure 1: Overview of the multi-agent red-teaming framework, illustrating the interaction between [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: Precision-Recall discrete operating points for the Proprietary Ads Safety benchmark and the [PITH_FULL_IMAGE:figures/full_fig_p014_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: Cumulative hard examples found versus the number of hypotheses tested, comparing agents [PITH_FULL_IMAGE:figures/full_fig_p015_3.png] view at source ↗
Figure 4
Figure 4. Figure 4: A synthetic image generated based on the Architect’s puppy mill hypothesis. While one [PITH_FULL_IMAGE:figures/full_fig_p016_4.png] view at source ↗
Figure 5
Figure 5. Figure 5: Synthetic images curated by our agents. The top row shows hard examples (with rater [PITH_FULL_IMAGE:figures/full_fig_p016_5.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

57 extracted references · 19 linked inside Pith

  1. [1]

    Security in llm-as-a-judge: A comprehensive sok.arXiv preprint arXiv:2603.29403, 2026

    Aiman Almasoud, Antony Anju, Marco Arazzi, Mert Cihangiroglu, Vignesh Kumar Kembu, Serena Nicolazzo, Antonino Nocera, Saraga Sakthidharan, et al. Security in llm-as-a-judge: A comprehensive sok.arXiv preprint arXiv:2603.29403, 2026

    Pith/arXiv arXiv 2026

  2. [2]

    Reference-guided verdict: Llms-as-judges in automatic evaluation of free-form qa

    Sher Badshah and Hassan Sajjad. Reference-guided verdict: Llms-as-judges in automatic evaluation of free-form qa. InProceedings of the 9th Widening NLP Workshop, pages 251–267, 2025

    2025

  3. [3]

    Reading between the pixels: Linking text-image embedding alignment to typographic attack success on vision-language models.arXiv preprint arXiv:2604.12371, 2026

    Ravikumar Balakrishnan, Sanket Mendapara, and Ankit Garg. Reading between the pixels: Linking text-image embedding alignment to typographic attack success on vision-language models.arXiv preprint arXiv:2604.12371, 2026

    Pith/arXiv arXiv 2026

  4. [4]

    Rethinking fine- tuning when scaling test-time compute: Limiting confidence improves mathematical reasoning

    Feng Chen, Allan Raventos, Nan Cheng, Surya Ganguli, and Shaul Druckmann. Rethinking fine- tuning when scaling test-time compute: Limiting confidence improves mathematical reasoning. arXiv preprint arXiv:2502.07154, 2025

    arXiv 2025

  5. [5]

    Every picture tells a dangerous story: Memory-augmented multi-agent jailbreak attacks on vlms.arXiv preprint arXiv:2604.12616, 2026

    Jianhao Chen, Haoyang Chen, Hanjie Zhao, Haozhe Liang, and Tieyun Qian. Every picture tells a dangerous story: Memory-augmented multi-agent jailbreak attacks on vlms.arXiv preprint arXiv:2604.12616, 2026

    Pith/arXiv arXiv 2026

  6. [6]

    The side effects of being smart: Safety risks in mllms’ multi-image reasoning.arXiv preprint arXiv:2601.14127, 2026

    Renmiao Chen, Yida Lu, Shiyao Cui, Xuan Ouyang, Victor Shea-Jay Huang, Shumin Zhang, Chengwei Pan, Han Qiu, and Minlie Huang. The side effects of being smart: Safety risks in mllms’ multi-image reasoning.arXiv preprint arXiv:2601.14127, 2026

    arXiv 2026

  7. [7]

    Evolve the method, not the prompts: Evolutionary synthesis of jailbreak attacks on llms.arXiv preprint arXiv:2511.12710, 2025

    Yunhao Chen, Xin Wang, Juncheng Li, Yixu Wang, Jie Li, Yan Teng, Yingchun Wang, and Xingjun Ma. Evolve the method, not the prompts: Evolutionary synthesis of jailbreak attacks on llms.arXiv preprint arXiv:2511.12710, 2025

    Pith/arXiv arXiv 2025

  8. [8]

    Jailbreaking llms & vlms: Mechanisms, evaluation, and unified defense.arXiv preprint arXiv:2601.03594, 2026

    Zejian Chen, Chaozhuo Li, Chao Li, Xi Zhang, Litian Zhang, and Yiming He. Jailbreaking llms & vlms: Mechanisms, evaluation, and unified defense.arXiv preprint arXiv:2601.03594, 2026

    arXiv 2026

  9. [9]

    Courtroom-style multi-agent debate with progressive rag and role-switching for controversial claim verification.arXiv preprint arXiv:2603.28488, 2026

    Masnun Nuha Chowdhury, Nusrat Jahan Beg, Umme Hunny Khan, Syed Rifat Raiyan, Md Kam- rul Hasan, and Hasan Mahmud. Courtroom-style multi-agent debate with progressive rag and role-switching for controversial claim verification.arXiv preprint arXiv:2603.28488, 2026

    Pith/arXiv arXiv 2026

  10. [10]

    Improv- ing factuality and reasoning in language models through multiagent debate

    Yilun Du, Shuang Li, Antonio Torralba, Joshua B Tenenbaum, and Igor Mordatch. Improv- ing factuality and reasoning in language models through multiagent debate. InForty-first international conference on machine learning, 2024

    2024

  11. [11]

    Bad students make great teachers: Active learning accelerates large-scale visual understanding

    Talfan Evans, Shreya Pathak, Hamza Merzic, Jonathan Schwarz, Ryutaro Tanno, and Olivier J Henaff. Bad students make great teachers: Active learning accelerates large-scale visual understanding. InEuropean Conference on Computer Vision, pages 264–280. Springer, 2024

    2024

  12. [12]

    Contextnav: Towards agentic multimodal in-context learning.arXiv preprint arXiv:2510.04560, 2025

    Honghao Fu, Yuan Ouyang, Kai-Wei Chang, Yiwei Wang, Zi Huang, and Yujun Cai. Contextnav: Towards agentic multimodal in-context learning.arXiv preprint arXiv:2510.04560, 2025

    arXiv 2025

  13. [13]

    Adversarial defense in vision-language models: An overview

    Xiaowei Fu and Lei Zhang. Adversarial defense in vision-language models: An overview. In2025 4th International Conference on Image Processing, Computer Vision and Machine Learning (ICICML), pages 1828–1831. IEEE, 2025

    2025

  14. [14]

    Detpo: In-context learning with multi-modal llms for few-shot object detection

    Gautam Rajendrakumar Gare, Neehar Peri, Matvei Popov, Shruti Jain, John Galeotti, and Deva Ramanan. Detpo: In-context learning with multi-modal llms for few-shot object detection. arXiv preprint arXiv:2603.23455, 2026

    Pith/arXiv arXiv 2026

  15. [15]

    Debate, deliberate, decide (d3): A cost-aware adversarial framework for reliable and interpretable llm evaluation

    Abir Harrasse, Chaithanya Bandi, and Hari Bandi. Debate, deliberate, decide (d3): A cost-aware adversarial framework for reliable and interpretable llm evaluation. InProceedings of the 19th Conference of the European Chapter of the Association for Computational Linguistics (Volume 1: Long Papers), pages 8376–8392, 2026

    2026

  16. [16]

    Aetheria: A multimodal interpretable content safety framework based on multi-agent debate and collaboration.arXiv preprint arXiv:2512.02530, 2025

    Yuxiang He, Jian Zhao, Yuchen Yuan, Tianle Zhang, Wei Cai, Haojie Cheng, Ziyan Shi, Ming Zhu, Haichuan Tang, Chi Zhang, et al. Aetheria: A multimodal interpretable content safety framework based on multi-agent debate and collaboration.arXiv preprint arXiv:2512.02530, 2025. 10

    arXiv 2025

  17. [17]

    Llavaguard: An open vlm-based framework for safeguarding vision datasets and models.arXiv preprint arXiv:2406.05113, 2024

    Lukas Helff, Felix Friedrich, Manuel Brack, Kristian Kersting, and Patrick Schramowski. Llavaguard: An open vlm-based framework for safeguarding vision datasets and models.arXiv preprint arXiv:2406.05113, 2024

    Pith/arXiv arXiv 2024

  18. [18]

    A judge-free llm open-ended generation benchmark based on the distributional hypothesis.arXiv preprint arXiv:2502.09316, 2025

    Kentaro Imajo, Masanori Hirano, Shuji Suzuki, and Hiroaki Mikami. A judge-free llm open-ended generation benchmark based on the distributional hypothesis.arXiv preprint arXiv:2502.09316, 2025

    Pith/arXiv arXiv 2025

  19. [19]

    Ai safety via debate.arXiv preprint arXiv:1805.00899, 2018

    Geoffrey Irving, Paul Christiano, and Dario Amodei. Ai safety via debate.arXiv preprint arXiv:1805.00899, 2018

    Pith/arXiv arXiv 2018

  20. [20]

    Adversarial attacks on multimodal large language models: A comprehensive survey.arXiv preprint arXiv:2603.27918, 2026

    Bhavuk Jain, Sercan Ö Arık, and Hardeo K Thakur. Adversarial attacks on multimodal large language models: A comprehensive survey.arXiv preprint arXiv:2603.27918, 2026

    arXiv 2026

  21. [21]

    Curriculum guided massive multi agent system solving for robust long horizon tasks.arXiv preprint arXiv:2512.08545, 2025

    Indrajit Kar and Kalathur Chenchu Kishore Kumar. Curriculum guided massive multi agent system solving for robust long horizon tasks.arXiv preprint arXiv:2512.08545, 2025

    arXiv 2025

  22. [22]

    Evaluating nova 2.0 lite model under amazon’s frontier model safety framework.arXiv preprint arXiv:2601.19134, 2026

    Satyapriya Krishna, Matteo Memelli, Tong Wang, Abhinav Mohanty, Claire O’Brien Rajkumar, Payal Motwani, Rahul Gupta, and Spyros Matsoukas. Evaluating nova 2.0 lite model under amazon’s frontier model safety framework.arXiv preprint arXiv:2601.19134, 2026

    arXiv 2026

  23. [23]

    Biasscope: Towards automated detection of bias in llm-as-a-judge evaluation.arXiv preprint arXiv:2602.09383, 2026

    Peng Lai, Zhihao Ou, Yong Wang, Longyue Wang, Jian Yang, Yun Chen, and Guanhua Chen. Biasscope: Towards automated detection of bias in llm-as-a-judge evaluation.arXiv preprint arXiv:2602.09383, 2026

    arXiv 2026

  24. [24]

    T-map: Red-teaming llm agents with trajectory-aware evolutionary search.arXiv preprint arXiv:2603.22341, 2026

    Hyomin Lee, Sangwoo Park, Yumin Choi, Sohyun An, Seanie Lee, and Sung Ju Hwang. T-map: Red-teaming llm agents with trajectory-aware evolutionary search.arXiv preprint arXiv:2603.22341, 2026

    arXiv 2026

  25. [25]

    Thinksafe: Self-generated safety alignment for reasoning models.arXiv preprint arXiv:2601.23143, 2026

    Seanie Lee, Sangwoo Park, Yumin Choi, Gyeongman Kim, Minki Kang, Jihun Yun, Dongmin Park, Jongho Park, and Sung Ju Hwang. Thinksafe: Self-generated safety alignment for reasoning models.arXiv preprint arXiv:2601.23143, 2026

    Pith/arXiv arXiv 2026

  26. [26]

    Holisafe: Holistic safety benchmarking and modeling for vision- language model.arXiv preprint arXiv:2506.04704, 2025

    Youngwan Lee, Kangsan Kim, Kwanyong Park, Ilcahe Jung, Soojin Jang, Seanie Lee, Yong-Ju Lee, and Sung Ju Hwang. Holisafe: Holistic safety benchmarking and modeling for vision- language model.arXiv preprint arXiv:2506.04704, 2025

    arXiv 2025

  27. [27]

    Adi Levi, Or Levi, Sardhendu Mishra, and Jonathan Morra. Ai vs. human moderators: A com- parative evaluation of multimodal llms in content moderation for brand safety. InProceedings of the IEEE/CVF International Conference on Computer Vision, pages 5965–5973, 2025

    2025

  28. [28]

    From generation to judg- ment: Opportunities and challenges of llm-as-a-judge

    Dawei Li, Bohan Jiang, Liangjie Huang, Alimohammad Beigi, Chengshuai Zhao, Zhen Tan, Amrita Bhattacharjee, Yuxuan Jiang, Canyu Chen, Tianhao Wu, et al. From generation to judg- ment: Opportunities and challenges of llm-as-a-judge. InProceedings of the 2025 Conference on Empirical Methods in Natural Language Processing, pages 2757–2791, 2025

    2025

  29. [29]

    Evaluating scoring bias in llm-as-a-judge.arXiv preprint arXiv:2506.22316, 2025

    Qingquan Li, Shaoyu Dou, Kailai Shao, Chao Chen, and Haixiang Hu. Evaluating scoring bias in llm-as-a-judge.arXiv preprint arXiv:2506.22316, 2025

    Pith/arXiv arXiv 2025

  30. [30]

    Who judges the judge? llm jury-on-demand: Building trustworthy llm evaluation systems.arXiv preprint arXiv:2512.01786, 2025

    Xiaochuan Li, Ke Wang, Girija Gouda, Shubham Choudhary, Yaqun Wang, Linwei Hu, Joel Vaughan, and Freddy Lecue. Who judges the judge? llm jury-on-demand: Building trustworthy llm evaluation systems.arXiv preprint arXiv:2512.01786, 2025

    arXiv 2025

  31. [31]

    Benchmark test-time scaling of general llm agents.arXiv preprint arXiv:2602.18998, 2026

    Xiaochuan Li, Ryan Ming, Pranav Setlur, Abhijay Paladugu, Andy Tang, Hao Kang, Shuai Shao, Rong Jin, and Chenyan Xiong. Benchmark test-time scaling of general llm agents.arXiv preprint arXiv:2602.18998, 2026

    arXiv 2026

  32. [32]

    Elhplan: Efficient long-horizon task planning for multi-agent collaboration.arXiv preprint arXiv:2509.24230, 2025

    Shaobin Ling, Yun Wang, Chenyou Fan, Tin Lun Lam, and Junjie Hu. Elhplan: Efficient long-horizon task planning for multi-agent collaboration.arXiv preprint arXiv:2509.24230, 2025

    arXiv 2025

  33. [33]

    Examining llms’ uncertainty expression towards questions outside parametric knowledge.arXiv preprint arXiv:2311.09731, 2023

    Genglin Liu, Xingyao Wang, Lifan Yuan, Yangyi Chen, and Hao Peng. Examining llms’ uncertainty expression towards questions outside parametric knowledge.arXiv preprint arXiv:2311.09731, 2023. 11

    Pith/arXiv arXiv 2023

  34. [34]

    We- bcoach: Self-evolving web agents with cross-session memory guidance.arXiv preprint arXiv:2511.12997, 2025

    Genglin Liu, Shijie Geng, Sha Li, Hejie Cui, Sarah Zhang, Xin Liu, and Tianyi Liu. We- bcoach: Self-evolving web agents with cross-session memory guidance.arXiv preprint arXiv:2511.12997, 2025

    Pith/arXiv arXiv 2025

  35. [35]

    Mosaic: Modeling social ai for content dissemination and regulation in multi-agent simulations

    Genglin Liu, Vivian T Le, Salman Rahman, Elisa Kreiss, Marzyeh Ghassemi, and Saadia Gabriel. Mosaic: Modeling social ai for content dissemination and regulation in multi-agent simulations. InProceedings of the 2025 Conference on Empirical Methods in Natural Language Processing, pages 6401–6428, 2025

    2025

  36. [36]

    Mtmcs-bench: Evaluating contextual safety of multimodal large language models in multi-turn dialogues.arXiv preprint arXiv:2601.06757, 2026

    Zheyuan Liu, Dongwhi Kim, Yixin Wan, Xiangchi Yuan, Zhaoxuan Tan, Fengran Mo, and Meng Jiang. Mtmcs-bench: Evaluating contextual safety of multimodal large language models in multi-turn dialogues.arXiv preprint arXiv:2601.06757, 2026

    arXiv 2026

  37. [37]

    Ai debate aids assessment of controversial claims.arXiv preprint arXiv:2506.02175, 2025

    Salman Rahman, Sheriff Issaka, Ashima Suvarna, Genglin Liu, James Shiffer, Jaeyoung Lee, Md Rizwan Parvez, Hamid Palangi, Shi Feng, Nanyun Peng, et al. Ai debate aids assessment of controversial claims.arXiv preprint arXiv:2506.02175, 2025

    arXiv 2025

  38. [38]

    X-teaming: Multi-turn jailbreaks and defenses with adaptive multi-agents.arXiv preprint arXiv:2504.13203, 2025

    Salman Rahman, Liwei Jiang, James Shiffer, Genglin Liu, Sheriff Issaka, Md Rizwan Parvez, Hamid Palangi, Kai-Wei Chang, Yejin Choi, and Saadia Gabriel. X-teaming: Multi-turn jailbreaks and defenses with adaptive multi-agents.arXiv preprint arXiv:2504.13203, 2025

    Pith/arXiv arXiv 2025

  39. [39]

    Disc-amc: Token-and parameter-efficient discretized statistics in-context automatic modulation classification.arXiv preprint arXiv:2510.00316, 2025

    Mohammad Rostami, Atik Faysal, Reihaneh Gh Roshan, Huaxia Wang, Nikhil Muralidhar, and Yu-Dong Yao. Disc-amc: Token-and parameter-efficient discretized statistics in-context automatic modulation classification.arXiv preprint arXiv:2510.00316, 2025

    arXiv 2025

  40. [40]

    Deliberative dynamics and value alignment in llm debates.arXiv preprint arXiv:2510.10002, 2025

    Pratik S Sachdeva and Tom van Nuenen. Deliberative dynamics and value alignment in llm debates.arXiv preprint arXiv:2510.10002, 2025

    Pith/arXiv arXiv 2025

  41. [41]

    Assessment of multimodal large language models in alignment with human values.arXiv preprint arXiv:2403.17830, 2024

    Zhelun Shi, Zhipin Wang, Hongxing Fan, Zaibin Zhang, Lijun Li, Yongting Zhang, Zhenfei Yin, Lu Sheng, Yu Qiao, and Jing Shao. Assessment of multimodal large language models in alignment with human values.arXiv preprint arXiv:2403.17830, 2024

    Pith/arXiv arXiv 2024

  42. [42]

    Llm-as-a-judge for time series explanations.arXiv preprint arXiv:2604.02118, 2026

    Preetham Sivalingam, Murari Mandal, Saurabh Deshpande, and Dhruv Kumar. Llm-as-a-judge for time series explanations.arXiv preprint arXiv:2604.02118, 2026

    arXiv 2026

  43. [43]

    Unigame: Turning a unified multimodal model into its own adversary.arXiv preprint arXiv:2511.19413, 2025

    Zhaolong Su, Wang Lu, Hao Chen, Sharon Li, and Jindong Wang. Unigame: Turning a unified multimodal model into its own adversary.arXiv preprint arXiv:2511.19413, 2025

    arXiv 2025

  44. [44]

    Supporting human raters with the detection of harmful content using large language models

    Kurt Thomas, Patrick Gage Kelley, David Tao, Sarah Meiklejohn, Owen Vallis, Shunwen Tan, Blaž Brataniˇc, Felipe Tiengo Ferreira, Vijay Kumar Eranti, and Elie Bursztein. Supporting human raters with the detection of harmful content using large language models. In2025 IEEE Symposium on Security and Privacy (SP), pages 2772–2789. IEEE, 2025

    2025

  45. [45]

    Automated concept discovery for llm-as-a-judge preference analysis.arXiv preprint arXiv:2603.03319, 2026

    James Wedgwood, Chhavi Yadav, and Virginia Smith. Automated concept discovery for llm-as-a-judge preference analysis.arXiv preprint arXiv:2603.03319, 2026

    arXiv 2026

  46. [46]

    Can llm agents really debate? a controlled study of multi-agent debate in logical reasoning.arXiv preprint arXiv:2511.07784, 2025

    Haolun Wu, Zhenkun Li, and Lingyao Li. Can llm agents really debate? a controlled study of multi-agent debate in logical reasoning.arXiv preprint arXiv:2511.07784, 2025

    arXiv 2025

  47. [47]

    Outsafe- bench: A benchmark for multimodal offensive content detection in large language models

    Yuping Yan, Yuhan Xie, Yuanshuai Li, Yingchao Yu, Lingjuan Lyu, and Yaochu Jin. Outsafe- bench: A benchmark for multimodal offensive content detection in large language models. arXiv preprint arXiv:2511.10287, 2025

    Pith/arXiv arXiv 2025

  48. [48]

    Llama-3.1-foundationai- securityllm-reasoning-8b technical report.arXiv preprint arXiv:2601.21051, 2026

    Zhuoran Yang, Ed Li, Jianliang He, Aman Priyanshu, Baturay Saglam, Paul Kassianik, Sajana Weerawardhena, Anu Vellore, Blaine Nelson, Neusha Javidnia, et al. Llama-3.1-foundationai- securityllm-reasoning-8b technical report.arXiv preprint arXiv:2601.21051, 2026

    arXiv 2026

  49. [49]

    When ais judge ais: The rise of agent-as-a-judge evaluation for llms.arXiv preprint arXiv:2508.02994, 2025

    Fangyi Yu. When ais judge ais: The rise of agent-as-a-judge evaluation for llms.arXiv preprint arXiv:2508.02994, 2025

    Pith/arXiv arXiv 2025

  50. [50]

    Evolving contextual safety in multi-modal large language models via inference-time self-reflective memory.arXiv preprint arXiv:2603.15800, 2026

    Ce Zhang, Jinxi He, Junyi He, Katia Sycara, and Yaqi Xie. Evolving contextual safety in multi-modal large language models via inference-time self-reflective memory.arXiv preprint arXiv:2603.15800, 2026. 12

    arXiv 2026

  51. [51]

    Visual exclusivity attacks: Automatic multimodal red teaming via agentic planning.arXiv preprint arXiv:2603.20198, 2026

    Yunbei Zhang, Yingqiang Ge, Weijie Xu, Yuhui Xu, Jihun Hamm, and Chandan K Reddy. Visual exclusivity attacks: Automatic multimodal red teaming via agentic planning.arXiv preprint arXiv:2603.20198, 2026

    arXiv 2026

  52. [52]

    Amulet: Realignment during test time for personalized preference adaptation of llms.arXiv preprint arXiv:2502.19148, 2025

    Zhaowei Zhang, Fengshuo Bai, Qizhi Chen, Chengdong Ma, Mingzhi Wang, Haoran Sun, Zilong Zheng, and Yaodong Yang. Amulet: Realignment during test time for personalized preference adaptation of llms.arXiv preprint arXiv:2502.19148, 2025

    Pith/arXiv arXiv 2025

  53. [53]

    inhumane conditions

    Zheng Zhang, Jiarui He, Yuchen Cai, Deheng Ye, Peilin Zhao, Ruili Feng, and Hao Wang. Gene- sis: Evolving attack strategies for llm web agent red-teaming.arXiv preprint arXiv:2510.18314, 2025. A Limitations While our automated red-teaming and dynamic retrieval framework significantly improves multimodal safety calibration, we identify a few limitations: R...

    arXiv 2025

  54. [54]

    {policy_text}

    Vulnerability Description: Identify a specific edge case or contradictory scenario under the given policy. 2. Scene Specification: Craft an elaborate description for an image generator to render the scenario. Ensure critical textual or visual elements are precisely specified. Reflect on previous iterations to avoid redundant probes and explore distinct vu...

  55. [55]

    This synthesizes a complete context block explicitly documenting the distinct arguments for and against each candidate classification label

    Argument Aggregation:First, the reasoning traces from all raters generated during the initial classification round are aggregated and grouped by their predicted label class. This synthesizes a complete context block explicitly documenting the distinct arguments for and against each candidate classification label

  56. [56]

    {policy_text}

    Debate Re-evaluation Prompting:The raters are then queried concurrently with a debate- specific prompt. This prompt provides the detailed argument context from all opposing and concurring perspectives as follows: You are an auditor in a panel discussion reviewing a safety determination under: Policy: "{policy_text}" 21 Review the following rationale provi...

  57. [57]

    If any dissent continues even after the debate round, the system automatically categorizes the instance as a deadlock and escalates it to the Level II Jury Committee

    Strict Consensus Rule:For any label to be adopted out of the debate structure, the pipeline enforces a rule of strict unanimity—all three raters must independently output the identical unified label post-debate. If any dissent continues even after the debate round, the system automatically categorizes the instance as a deadlock and escalates it to the Lev...