Adversarial Stress Testing of Role-Playing Language Agents using Multi-Agent Evaluation

Abdullah Nazly; Januki Wanniarachchi; Ravisha De Alwis; Saqib Shouqi

REVIEW 4 major objections 4 minor 28 references

Adversarial Stress Testing of Role-Playing Language Agents using Multi-Agent Evaluation

T0 review · 4 major / 4 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read This paper claims that single-prompt or single-strategy evaluations systematically overstate the robustness of role-playing language agents, and that sustained multi-strategy adversarial testing lowers measured robustness scores by 0.17–0.2

desk verdict A useful multi-agent red-teaming framework for role-playing agents, but the headline robustness drop rests on a composite metric whose drift component was never validated. read the letter →

arxiv 2608.03166 v1 pith:W5XYDYBR submitted 2026-08-04 cs.AI

Saqib Shouqi , Abdullah Nazly , Januki Wanniarachchi , Ravisha De Alwis This is my paper

classification cs.AI

keywords adversarialevaluationrole-playinglanguageagentsmulti-agentredteamingLLMrobustnesspersonadriftautomatedjudgingpromptattacksAIsafety

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper claims that single-prompt or single-strategy evaluations systematically overstate the robustness of role-playing language agents. It builds a three-agent platform where an Interrogator Agent applies six adversarial strategies across ten-turn dialogues, a Target Agent plays the persona under test, and a Judging Agent scores role fidelity, drift, ethical deviation, and consistency. Across three personas and three LLM families, moving from a one-strategy baseline to the full multi-strategy suite lowered overall robustness scores by 0.17–0.20 points on average. The authors take this as evidence that cumulative, multi-turn adversarial pressure exposes failure modes—role abandonment, constraint violations, tone instability—that shorter or narrower evaluations miss. If right, standard robustness claims for deployed role-playing agents should be treated as upper bounds until tested under sustained multi-strategy pressure.

What carries the argument

The load-bearing mechanism is the three-agent evaluation loop: a strategy-driven Interrogator Agent that escalates from low-difficulty probes (turns 1–3) to high-pressure strategies, a black-box Target Agent, and a non-participating Judging Agent that scores the full dialogue. The judgment is carried by four rule-based metrics — Role Fidelity (Eq. 1), Drift Index (Eq. 2), Ethical Deviation (Eq. 3), and Consistency Score (Eq. 4) — combined into an Overall Score (Eq. 5) with weights set by pilot testing. The Interrogator's progressive difficulty selection is what makes failures appear late in the conversation, so the metrics' sensitivity to timing is essential to the result.

What would settle it

Run the same six-strategy conversations but score each turn with full human judgment rather than the keyword-based Overall Score, and check whether the 0.17–0.20 drop between single-strategy and multi-strategy conditions persists after controlling for conversation length and lexical diversity. If the drop shrinks to near zero, the reported robustness decline is an artifact of the judge, not the agents.

Watch

Extended reading notes

Core claim

The central claim is that robustness is a property of sustained interaction, not isolated responses. In controlled 10-turn experiments, replacing a single-strategy adversary (Role Drift only) with six coordinated strategies produced consistent degradation in every persona: Healthcare Assistant Overall fell from 0.837 to 0.634, Customer Support from 0.867 to 0.693, and Financial Advisor from 0.850 to 0.661. Cross-model runs on the Healthcare Assistant repeated the degradation for GPT-4o-mini (0.681) and Claude-3.5-Haiku (0.712), and Authority Challenge and Emotional Manipulation induced the largest ethical deviations in all three models. The authors conclude that single-strategy evaluation me

Load-bearing premise

The central claim collapses if the automated judge's rule-based metrics penalize longer or more strategy-diverse conversations for reasons other than genuine role or ethics failures; the human validation (r = 0.82) covers only the Role Fidelity component, not the overall score.

Editorial extensions

If this is right

Single-strategy evaluations should not be read as robustness certificates: the reported 0.17–0.20 point drop on a 0–1 scale implies such tests overstate real-world reliability.
Deployers of role-playing agents in healthcare, finance, or support should expect failures to concentrate after several turns of adversarial pressure, since most violations appeared after turn 5–6.
The rank order of attack effectiveness (Authority Challenge and Emotional Manipulation strongest) was stable across three LLM families, so defensive priorities can be set without per-model red-teaming.
Automated judging with human calibration can scale evaluation, but the reported alignment is strongest for role fidelity; ethical deviation and consistency need their own calibration.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

If robustness declines monotonically with conversation length, the 10-turn ceiling likely understates deployed failures; a 20-turn adversarial conversation should be tested to see whether degradation plateaus or continues.
The same multi-agent loop could be turned into a training signal: responses that trigger the judge's drift or ethical-deviation penalties could serve as hard negatives for preference optimization, an extension this paper does not propose.
The architecture-independent ordering of failure modes suggests a shared taxonomy of adversarial strategies may transfer across model generations, making the strategy library reusable without redesigning attacks.
A testable extension is to compare multi-strategy scores against randomly ordered single-strategy scores with equal conversation length; this isolates whether strategy diversity, rather than total number of adversarial turns, drives the observed drop.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

Quick take: this is a genuinely useful framework paper—multi-agent, multi-strategy adversarial evaluation with persona-specific constraints and an automated judge. That combination, as far as I can tell from the cited work, is new. The authors also do the right things: they run three personas, three model families, compare single vs. multi-strategy, and report human validation of the judge. The cross-model consistency and the qualitative failure examples make the central phenomenon—sustained adversarial pressure degrades role-playing agents—very plausible.

Where it gets shaky is the exact headline numbers. The abstract says multi-strategy drops robustness by 0.17–0.20, and the conclusion says single-strategy evaluation overestimates robustness. But the baseline condition uses only Role Drift, so the drop conflates 'number of strategies' with 'type of strategy.' A fairer baseline would include each strategy individually or a single non-Role-Drift strategy. And the drop is computed from the Overall score (Eq. 5), which includes the Drift Index (Eq. 2). The human validation (Sec. 6.6) scored per-turn RF, ED, CS, but never validated DI or an Overall score. The reported r=0.82 is for role fidelity only. So the central quantitative claim is not directly validated by the human study. The stress-test note is right about this—Eq. 2 could fire simply because later turns discuss different topics, and the 'to be honest' abandonment pattern could fire during empathetic responses. That's a real hole.

That said, the framework itself is sound and the limitations section is unusually honest. Three seeds is thin for the t-tests, and the open-source claim needs to be backed by an actual link. But these are addressable, not fatal. The paper would benefit from a baseline that varies strategies one by one, a validation of DI and Overall against human judgments, and more seeds.

Bottom line: this is a solid engineering contribution with a plausible but not yet fully supported empirical claim. I'd send it to review, with the clear expectation that the authors strengthen the judge validation and baseline. If they can do that, the framework is citable for anyone working on evaluation of role-playing or conversational agents.

Referee Report

4 major / 4 minor

Summary. The paper presents a modular multi-agent platform for adversarial stress-testing of role-playing language agents (RPLAs). The system coordinates an Interrogator Agent that applies six structured attack strategies over multi-turn dialogue, a Target Agent under test, and a Judging Agent that computes rule-based scores for Role Fidelity (RF), Drift Index (DI), Ethical Deviation (ED), and Consistency (CS), combined into an Overall score. Experiments are run across three personas (Healthcare Assistant, Customer Support Agent, Financial Advisor) and three LLM families (Llama-3.3-70B, GPT-4o-mini, Claude-3.5-Haiku). The central claim, stated in Section 7.1, is that transitioning from single-strategy (Role Drift only) to multi-strategy adversarial evaluation causes a substantial, consistent robustness decline (0.17-0.20 points), implying that single-strategy evaluation overestimates RPLA robustness. The abstract also reports automated judging aligns with human ratings (r=0.82, Fleiss' kappa=0.71). The paper is released as an open-source platform.

Significance. If the central claim were fully supported, the paper would make a practically important point: short, single-prompt or single-strategy red-teaming can systematically overstate the reliability of deployed role-playing agents. The open-source platform, the multi-agent architecture, and the cross-model comparisons are useful contributions. The human validation study, although partial, is a serious attempt to ground the automated judge, and the authors explicitly discuss limitations. However, as presented, the headline quantitative result rests on an unvalidated aggregate metric and a confounded experimental comparison, so the significance is conditional on additional validation and analysis.

major comments (4)

[Section 6.5 / 7.1] The baseline condition is defined as single-strategy with Role Drift only, while the experimental condition uses all six strategies. The comparison therefore conflates the number of strategies with the type/strength of adversarial pressure. A drop could arise simply because the multi-strategy condition includes more effective attacks (e.g., Emotional Manipulation) rather than because diversity of strategies matters. To support the claim that 'single-strategy evaluation overestimates robustness,' the authors should include single-strategy baselines for other strategies (Ethical Probing, Authority Challenge, etc.) or otherwise control for attack intensity.
[Sections 6.4 and 6.6 / Eq. 5] The headline 0.17-0.20 drop is computed from the Overall score (Eq. 5), a weighted composite of RF, DI, ED, and CS. The human validation study in Section 6.6 validates only per-turn RF, ED, and CS using 60 turns; it does not validate DI (Eq. 2) and does not report a correlation for the Overall composite. The abstract's r=0.82 is specifically for RF, with ED=0.78 and CS=0.75. Because 20% of the Overall weight comes from (1-DI), the central quantitative claim depends on an unvalidated metric. The authors should report human correlation for DI and for the Overall score, or at least show that the main result survives when DI is excluded.
[Section 6.1 / Table 6] Statistical support for the 'consistent decline' claim is thin. Table 6 reports only point estimates with no variance, despite Section 6.1 stating that each condition was run with 3 random seeds. Table 7 reports means and standard deviations from three seeds, and the paired t-tests described in Section 7.2 have at most n=3. Three seeds cannot support robust statistical inference. The authors should report per-seed results, confidence intervals, or use more seeds, and present variance information for Table 6.
[Section 6.4, Eq. 2] The Drift Index as defined compares mean role-term density in the first half versus the second half of the conversation. Under the multi-strategy condition, later turns use different strategies (e.g., Emotional Manipulation, Authority Challenge) that naturally shift vocabulary and topic, so DI may increase mechanically rather than due to genuine role abandonment. Similarly, the role-abandonment keyword 'to be honest' in Eq. 1 may occur during empathetic responses without actual persona breaks. The paper's own Section 9 acknowledges that the judge may introduce bias. Without qualitative validation or targeted ablations, the measured decline could partly reflect keyword artifacts of conversation length and topic shift.

minor comments (4)

[Table 1] The table's checkmark/cross symbols are misaligned, making the comparison matrix hard to read.
[References] Some references have issues: [6] and [10] share the same arXiv identifier (2506.18036); [26] appears to be cited for LLM-as-judge but the listed title concerns robot task planning; several entries lack author names. Please correct these.
[Section 6.6] The phrase 'stratified sample of 60 conversation turns' would benefit from a precise description of the stratification (e.g., by persona, condition, turn position).
[Section 7.1] The abstract says 'reducing overall robustness scores by 0.17--0.20 points on average,' but Table 6 shows declines of 0.174, 0.203, and 0.189. The abstract range is consistent, but the wording 'on average' is slightly misleading because the reported drop varies by persona.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: the headline drop is an empirical measurement, not a quantity forced by the metric equations or by self-citation.

full rationale

The paper's central quantitative claim is that the Overall composite (Eq. 5) declines by 0.17-0.20 when moving from a single-strategy (Role Drift only) to a six-strategy adversarial condition (Tables 6-7). This is not a fitted parameter or a prediction derived from the metric definitions; it is an observed difference in scores computed under two experimental conditions. Nothing in Eqs. 1-5 forces the multi-strategy scores to be lower: a perfectly robust agent could keep RF, DI, ED, and CS unchanged. The judge weights were pilot-tuned (Sec. 6.4), but the headline comparison is not the quantity being fit; the pilot tuning calibrates sensitivity, not the result. The paper contains no self-citations and does not invoke any uniqueness theorem from the authors' prior work. The validation study (Sec. 6.6) correlates automated scores with human scores using the same rubrics, which is a consistency check rather than external construct validation, and it does not validate the Drift Index (Eq. 2) or the Overall composite; moreover, Sec. 9 explicitly concedes the automated judge 'may still introduce bias.' These are validity/robustness limitations, not circular reductions: the reported drop is not equivalent to the metric definitions by construction. Hence no circularity step meets the evidentiary bar; the correct score is 0.

Assumptions & free parameters 6 free parameters · 5 assumptions · 0 invented entities

The central empirical claim depends on the authors' own metric rubric, whose weights are fit in pilot testing, plus several domain assumptions about the validity of keyword-based scoring, the coverage of the strategy set, and the sufficiency of small human and seed samples.

free parameters (6)

RF weights = 0.4, 0.3, 0.3
Weights in Role Fidelity formula 'determined through pilot testing' (Sec 6.4).
Overall score weights = 0.3, 0.2, 0.3, 0.2
Composite weights for RF, (1-DI), (1-ED), CS in Eq. 5 (Sec 6.4).
Expected role-term count = 20 (example)
Denominator for role-language consistency R_con in Sec 6.4; not justified.
Tone shift penalty = 0.1
Coefficient in CS formula Eq. 4 (Sec 6.4).
ED normalization factor = 2
Multiplier in Eq. 3 (Sec 6.4).
Difficulty threshold = <=3 for early turns
Progressive strategy selection in Sec 6.3.

assumptions (5)

domain assumption Keyword pattern matching of the target's raw text is a valid measure of role fidelity, drift, and ethical deviation.
The judge's metrics rely on TF-IDF term density, keyword lists, and phrase detection (Sec 6.4); no evidence that these capture semantic role adherence.
domain assumption The six adversarial strategies cover the relevant space of user pressure and are correctly implemented by the LLM-based Interrogator.
Strategy set is selected from known failure patterns (Sec 5.1), but no coverage analysis or prompt-level audit is provided.
domain assumption 60 human-scored turns constitute a sufficient ground-truth sample for validating the automated judge.
Judge validation (Sec 6.6) uses one stratified sample of 60 turns and 3 experts; adequate for exploratory validation but narrow for the claims.
domain assumption Three random seeds per condition support the paired t-test claims.
Cross-model validation reports p<0.01 with n=3 seeds per model (Sec 7.2); with df=2, this requires a very large effect and is fragile.
domain assumption The target model is treated as a black box; no access to internal states is assumed.
Sec 4.2.1 states the Target is a black box; this is reasonable but implies the framework cannot distinguish prompt-level from model-level causes.

how reviews work

0 comments

Cite this review

Pith. "Pith review of Adversarial Stress Testing of Role-Playing Language Agents using Multi-Agent Evaluation." pith.science (2026). https://pith.science/paper/W5XYDYBR

@misc{pith2026260803166,
  author       = {Pith},
  title        = {Pith review of: Adversarial Stress Testing of Role-Playing Language Agents using Multi-Agent Evaluation},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/W5XYDYBR}},
  note         = {Machine review of arXiv:2608.03166}
}

abstract

Role-Playing Language Agents (RPLAs) are increasingly deployed in high-stakes applications such as healthcare assistance, customer support, and education, where maintaining consistent personas, ethical constraints, and behavioral coherence under adversarial pressure is critical. Existing evaluation approaches rely on static benchmarks or isolated single-turn prompts that fail to capture cumulative behavioral failures emerging over extended interactions. We present a modular multi-agent platform for adversarially stress-testing RPLAs through structured, multi-turn dialogue. The system coordinates three agents: a strategy-driven Interrogator Agent that applies six progressive adversarial strategies, a Target Agent representing the RPLA under evaluation, and an automated Judging Agent that scores behavior across role fidelity, drift, ethical deviation, and consistency dimensions. Through experiments across three personas and three LLM families, we demonstrate that multi-strategy adversarial evaluation reveals failure modes invisible to single-strategy testing, reducing overall robustness scores by 0.17--0.20 points on average. Cross-model validation confirms consistent degradation patterns across Llama-3.3-70B, GPT-4o-mini, and Claude-3.5-Haiku, with Authority Challenge and Emotional Manipulation emerging as the most effective attack strategies. Automated judging achieves strong human alignment ($r = 0.82$, Fleiss' $\kappa = 0.71$). This work is released as an open-source platform to support AI safety and reproducible RPLA benchmarking. While the framework enables systematic discovery of failure modes, we acknowledge potential ethical risks associated with adversarial testing methodologies and emphasize responsible usage for improving AI safety.

Figures

Figures reproduced from arXiv: 2608.03166 by the authors.

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

28 extracted references · 13 canonical work pages

[1]

The Oscars of AI Theater: A Survey on Role- Playing with Language Models,

N. Chen, Y. Wang, Y. Deng, and J. Li, “The Oscars of AI Theater: A Survey on Role- Playing with Language Models, ”arXiv preprint arXiv:2407.11484, 2024. [Online]. Available: https://arxiv.org/pdf/2407.11484

arXiv 2024
[2]

ASSERT: Automated Safety Scenario Red Teaming for Evaluating the Robustness of Large Language Models,

A. Mei, S. Levy, and W. Y. Wang, “ASSERT: Automated Safety Scenario Red Teaming for Evaluating the Robustness of Large Language Models, ”arXiv preprint arXiv:2310.09624, 2023. [Online]. Available: https://arxiv.org/abs/2310.09624

arXiv 2023
[3]

HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusal,

M. Mazeika, L. Phan, X. Yin, et al., “HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusal, ”arXiv preprint arXiv:2402.04249, 2024. [Online]. Available: https://arxiv.org/abs/2402.04249

arXiv 2024
[4]

RoleMRC: A Fine-Grained Composite Benchmark for Role-Playing Language Agents,

J. Lu, Y. Zhao, H. Wang, et al., “RoleMRC: A Fine-Grained Composite Benchmark for Role-Playing Language Agents, ” inProceedings of the ACL, 2025

work page 2025
[5]

AART: AI-Assisted Red-Teaming with Diverse Data Generation for New LLM-powered Applications,

A. Radharapu, K. Robinson, L. Aroyo, and P. Lahoti, “AART: AI-Assisted Red-Teaming with Diverse Data Generation for New LLM-powered Applications, ”arXiv preprint arXiv:2311.08592, 2023. [Online]. Available: https://arxiv.org/abs/2311.08592

arXiv 2023
[7]

Adversarial Testing in LLMs: Insights into Decision-Making Vulnerabilities

L. Zhang, H. Wang, L. Cheng, L. Deng, and T. Ward, “Adversarial Testing in Large Language Models: Insights into Decision-Making Vulnerabilities, ”arXiv preprint arXiv:2505.13195, 2025. [Online]. Available: https://arxiv.org/abs/2505.13195

work page Pith review arXiv 2025
[8]

Red Teaming Large Language Models: A Comprehensive Review and Critical Analysis,

“Red Teaming Large Language Models: A Comprehensive Review and Critical Analysis, ”Information Processing & Management, vol. 62, no. 6, 2025

work page 2025
[9]

Security of LLM-based Agents: Attacks, Defenses, and Applications,

“Security of LLM-based Agents: Attacks, Defenses, and Applications, ”Information Fusion, vol. 127, pp. 1–20, 2026

work page 2026

Show all 28 references

[10]

From LLMs to Agents: A Sur- vey of Jailbreak Attacks and Defenses in the LLM Ecosystem,

Y. Mao, T. Cui, P. Liu, D. You, and H. Zhu, “From LLMs to Agents: A Sur- vey of Jailbreak Attacks and Defenses in the LLM Ecosystem, ”arXiv preprint arXiv:2506.18036, 2025. [Online]. Available: https://arxiv.org/abs/2506.18036

2025 arXiv
[11]

Red-Teaming Large Language Models using Chain of Utterances for Safety-Alignment,

R. Bhardwaj and S. Poria, “Red-Teaming Large Language Models using Chain of Utterances for Safety-Alignment, ”arXiv preprint arXiv:2308.09662, 2023. [Online]. Available: https://arxiv.org/abs/2308.09662

2023 arXiv
[12]

RedDebate: Safer Responses through Multi-Agent Red Teaming Debates,

A. Asad, S. Obadinma, R. Shayanfar, and X. Zhu, “RedDebate: Safer Responses through Multi-Agent Red Teaming Debates, ”arXiv preprint arXiv:2506.11083, 2025. [Online]. Available: https://arxiv.org/abs/2506.11083

2025 arXiv
[13]

MART: Improving LLM Safety with Multi-round Automatic Red-Teaming,

S. Ge et al., “MART: Improving LLM Safety with Multi-round Automatic Red-Teaming, ”arXiv preprint arXiv:2311.07689, 2023. [Online]. Available: https://arxiv.org/abs/2311.07689

2023 arXiv
[14]

Evil Geniuses: Delving into the Safety of LLM-based Agents,

Y. Tian, X. Yang, J. Zhang, Y. Dong, and H. Su, “Evil Geniuses: Delving into the Safety of LLM-based Agents, ”arXiv preprint arXiv:2311.11855, 2023. [Online]. Available: https://arxiv.org/abs/2311.11855

2023 arXiv
[15]

RedA- gent: Red Teaming Large Language Models with Context-aware Autonomous Language Agent,

H. Xu, W. Zhang, Z. Wang, F. Xiao, R. Zheng, Y. Feng, Z. Ba, and K. Ren, “RedA- gent: Red Teaming Large Language Models with Context-aware Autonomous Language Agent, ”arXiv preprint arXiv:2407.16667, 2024. [Online]. Available: https://arxiv.org/abs/2407.16667

2024 arXiv
[16]

AutoRedTeamer: Autonomous Red Teaming with Lifelong At- tack Integration,

N. Pinckney, C. Deng, C.-T. Ho, Y.-D. Tsai, M. Liu, W. Zhou, B. Khailany, and H. Ren, “AutoRedTeamer: Autonomous Red Teaming with Lifelong At- tack Integration, ”arXiv preprint arXiv:2503.01304, 2025. [Online]. Available: https://arxiv.org/abs/2503.01304

2025 arXiv
[17]

Exposing Weak Links in Multi-Agent Systems under Adver- sarial Prompting,

N. Arora et al., “Exposing Weak Links in Multi-Agent Systems under Adver- sarial Prompting, ”arXiv preprint arXiv:2511.10949, 2025. [Online]. Available: https://arxiv.org/pdf/2511.10949.pdf

2025
[19]

AgentHarm: A Benchmark for Measuring Harmfulness of LLM Agents,

M. Andriushchenko, A. Souly, M. Dziemian, D. Duenas, M. Lin, J. Wang, D. Hendrycks, A. Zou, Z. Kolter, M. Fredrikson, E. Winsor, J. Wynne, Y. Gal, and X. Davies, “AgentHarm: A Benchmark for Measuring Harmfulness of LLM Agents, ”arXiv preprint arXiv:2410.17458, 2024. [Online]. ...

2024 arXiv
[20]

SafeGenBench: A Benchmark Framework for Security Vulnerability Detection in LLM-Generated Code,

“SafeGenBench: A Benchmark Framework for Security Vulnerability Detection in LLM-Generated Code, ”arXiv preprint arXiv:2506.05692, 2025. [Online]. Available: https://arxiv.org/abs/2506.05692

2025 arXiv
[21]

From Prompt Injections to Protocol Exploits: Threats in LLM-Powered AI Agent Workflows,

“From Prompt Injections to Protocol Exploits: Threats in LLM-Powered AI Agent Workflows, ”arXiv preprint arXiv:2506.23260, 2025. [Online]. Available: https://arxiv.org/abs/2506.23260

2025
[22]

AvalonBench: Evaluating LLMs Playing the Game of Avalon,

“AvalonBench: Evaluating LLMs Playing the Game of Avalon, ”arXiv preprint arXiv:2311.12345, 2023. [Online]. Available: https://arxiv.org/abs/2311.12345

2023 arXiv
[23]

Foot-In-The-Door: A Multi-turn Jailbreak for LLMs,

“Foot-In-The-Door: A Multi-turn Jailbreak for LLMs, ”arXiv preprint arXiv:2502.01987, 2025. [Online]. Available: https://arxiv.org/abs/2502.01987

2025 arXiv
[24]

LLM Agent Black-Box Fuzzing Framework: AgentXploit Method- ology,

“LLM Agent Black-Box Fuzzing Framework: AgentXploit Method- ology, ”arXiv preprint arXiv:2505.13137, 2025. [Online]. Available: https://arxiv.org/abs/2505.13137

2025 arXiv
[26]

Safety-Aware Framework for LLM Task Planning in Robotics,

“Safety-Aware Framework for LLM Task Planning in Robotics, ”arXiv preprint arXiv:2503.11241, 2025. [Online]. Available: https://arxiv.org/abs/2503.11241

2025 arXiv
[27]

SWEET-RL: Training Multi-Turn LLM Agents on Collaborative Rea- soning Tasks,

Y. Zhou, S. Jiang, Y. Tian, J. Weston, S. Levine, S. Sukhbaatar, and X. Li, “SWEET-RL: Training Multi-Turn LLM Agents on Collaborative Rea- soning Tasks, ”arXiv preprint arXiv:2503.12589, 2025. [Online]. Available: https://arxiv.org/abs/2503.12589

2025 arXiv
[28]

CoP: Agentic Red-teaming for Large Language Models,

“CoP: Agentic Red-teaming for Large Language Models, ” arXiv preprint arXiv:2409.00787, 2024. [Online]. Available: https://openreview.net/pdf/cb30447780175b5ce7f25d0e0277ddcc32156544.pdf

2024 arXiv
[29]

Benchmarking Multi-Agent Safety and Coordination in LLM Ecosys- tems,

“Benchmarking Multi-Agent Safety and Coordination in LLM Ecosys- tems, ”arXiv preprint arXiv:2501.09865, 2025. [Online]. Available: https://arxiv.org/abs/2501.09865

2025 arXiv
[2024]

Available: https://arxiv.org/abs/2403.01942

[Online]. Available: https://arxiv.org/abs/2403.01942

arXiv
[2025]

Available: https://arxiv.org/abs/2508.17458

[Online]. Available: https://arxiv.org/abs/2508.17458

arXiv

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.

[1] [1]

The Oscars of AI Theater: A Survey on Role- Playing with Language Models,

N. Chen, Y. Wang, Y. Deng, and J. Li, “The Oscars of AI Theater: A Survey on Role- Playing with Language Models, ”arXiv preprint arXiv:2407.11484, 2024. [Online]. Available: https://arxiv.org/pdf/2407.11484

arXiv 2024

[2] [2]

ASSERT: Automated Safety Scenario Red Teaming for Evaluating the Robustness of Large Language Models,

A. Mei, S. Levy, and W. Y. Wang, “ASSERT: Automated Safety Scenario Red Teaming for Evaluating the Robustness of Large Language Models, ”arXiv preprint arXiv:2310.09624, 2023. [Online]. Available: https://arxiv.org/abs/2310.09624

arXiv 2023

[3] [3]

HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusal,

M. Mazeika, L. Phan, X. Yin, et al., “HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusal, ”arXiv preprint arXiv:2402.04249, 2024. [Online]. Available: https://arxiv.org/abs/2402.04249

arXiv 2024

[4] [4]

RoleMRC: A Fine-Grained Composite Benchmark for Role-Playing Language Agents,

J. Lu, Y. Zhao, H. Wang, et al., “RoleMRC: A Fine-Grained Composite Benchmark for Role-Playing Language Agents, ” inProceedings of the ACL, 2025

work page 2025

[5] [5]

AART: AI-Assisted Red-Teaming with Diverse Data Generation for New LLM-powered Applications,

A. Radharapu, K. Robinson, L. Aroyo, and P. Lahoti, “AART: AI-Assisted Red-Teaming with Diverse Data Generation for New LLM-powered Applications, ”arXiv preprint arXiv:2311.08592, 2023. [Online]. Available: https://arxiv.org/abs/2311.08592

arXiv 2023

[6] [7]

Adversarial Testing in LLMs: Insights into Decision-Making Vulnerabilities

L. Zhang, H. Wang, L. Cheng, L. Deng, and T. Ward, “Adversarial Testing in Large Language Models: Insights into Decision-Making Vulnerabilities, ”arXiv preprint arXiv:2505.13195, 2025. [Online]. Available: https://arxiv.org/abs/2505.13195

work page Pith review arXiv 2025

[7] [8]

Red Teaming Large Language Models: A Comprehensive Review and Critical Analysis,

“Red Teaming Large Language Models: A Comprehensive Review and Critical Analysis, ”Information Processing & Management, vol. 62, no. 6, 2025

work page 2025

[8] [9]

Security of LLM-based Agents: Attacks, Defenses, and Applications,

“Security of LLM-based Agents: Attacks, Defenses, and Applications, ”Information Fusion, vol. 127, pp. 1–20, 2026

work page 2026