{"id":"https://openalex.org/W7140136566","doi":"https://doi.org/10.48550/arxiv.2603.19247","title":"When Prompt Optimization Becomes Jailbreaking: Adaptive Red-Teaming of Large Language Models","display_name":"When Prompt Optimization Becomes Jailbreaking: Adaptive Red-Teaming of Large Language Models","publication_year":2026,"publication_date":"2026-02-21","ids":{"openalex":"https://openalex.org/W7140136566","doi":"https://doi.org/10.48550/arxiv.2603.19247"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2603.19247","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2603.19247","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"article"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2603.19247","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5130370343","display_name":"Zafir Shamsi","orcid":null},"institutions":[],"countries":[],"is_corresponding":true,"raw_author_name":"Shamsi, Zafir","raw_affiliation_strings":[],"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5130335217","display_name":"Nikhil Chekuru","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Chekuru, Nikhil","raw_affiliation_strings":[],"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5130402660","display_name":"Zachary Guzman","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Guzman, Zachary","raw_affiliation_strings":[],"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5130379656","display_name":"Shivank Garg","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Garg, Shivank","raw_affiliation_strings":[],"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":4,"corresponding_author_ids":["https://openalex.org/A5130370343"],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.9398999810218811,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.9398999810218811,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10883","display_name":"Ethics and Social Impacts of AI","score":0.008100000210106373,"subfield":{"id":"https://openalex.org/subfields/3311","display_name":"Safety Research"},"field":{"id":"https://openalex.org/fields/33","display_name":"Social Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}},{"id":"https://openalex.org/T12026","display_name":"Explainable Artificial Intelligence (XAI)","score":0.007300000172108412,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/adversarial-system","display_name":"Adversarial system","score":0.6909000277519226},{"id":"https://openalex.org/keywords/component","display_name":"Component (thermodynamics)","score":0.5440999865531921},{"id":"https://openalex.org/keywords/vulnerability","display_name":"Vulnerability (computing)","score":0.54339998960495},{"id":"https://openalex.org/keywords/baseline","display_name":"Baseline (sea)","score":0.5407000184059143},{"id":"https://openalex.org/keywords/language-model","display_name":"Language model","score":0.49630001187324524},{"id":"https://openalex.org/keywords/residual","display_name":"Residual","score":0.476500004529953},{"id":"https://openalex.org/keywords/outcome","display_name":"Outcome (game theory)","score":0.4153999984264374}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6935999989509583},{"id":"https://openalex.org/C37736160","wikidata":"https://www.wikidata.org/wiki/Q1801315","display_name":"Adversarial system","level":2,"score":0.6909000277519226},{"id":"https://openalex.org/C168167062","wikidata":"https://www.wikidata.org/wiki/Q1117970","display_name":"Component (thermodynamics)","level":2,"score":0.5440999865531921},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.54339998960495},{"id":"https://openalex.org/C12725497","wikidata":"https://www.wikidata.org/wiki/Q810247","display_name":"Baseline (sea)","level":2,"score":0.5407000184059143},{"id":"https://openalex.org/C137293760","wikidata":"https://www.wikidata.org/wiki/Q3621696","display_name":"Language model","level":2,"score":0.49630001187324524},{"id":"https://openalex.org/C155512373","wikidata":"https://www.wikidata.org/wiki/Q287450","display_name":"Residual","level":2,"score":0.476500004529953},{"id":"https://openalex.org/C148220186","wikidata":"https://www.wikidata.org/wiki/Q7111912","display_name":"Outcome (game theory)","level":2,"score":0.4153999984264374},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.4041000008583069},{"id":"https://openalex.org/C111335779","wikidata":"https://www.wikidata.org/wiki/Q3454686","display_name":"Reduction (mathematics)","level":2,"score":0.4034999907016754},{"id":"https://openalex.org/C204323151","wikidata":"https://www.wikidata.org/wiki/Q905424","display_name":"Range (aeronautics)","level":2,"score":0.39320001006126404},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.38690000772476196},{"id":"https://openalex.org/C94361409","wikidata":"https://www.wikidata.org/wiki/Q7882500","display_name":"Uncertainty reduction theory","level":2,"score":0.28949999809265137},{"id":"https://openalex.org/C179603123","wikidata":"https://www.wikidata.org/wiki/Q1941921","display_name":"Modeling language","level":3,"score":0.27129998803138733},{"id":"https://openalex.org/C2983448237","wikidata":"https://www.wikidata.org/wiki/Q1078276","display_name":"Language understanding","level":2,"score":0.2605000138282776},{"id":"https://openalex.org/C112930515","wikidata":"https://www.wikidata.org/wiki/Q4389547","display_name":"Risk analysis (engineering)","level":1,"score":0.2590000033378601},{"id":"https://openalex.org/C167063184","wikidata":"https://www.wikidata.org/wiki/Q1400839","display_name":"Vulnerability assessment","level":3,"score":0.25859999656677246},{"id":"https://openalex.org/C18762648","wikidata":"https://www.wikidata.org/wiki/Q42213","display_name":"Work (physics)","level":2,"score":0.25360000133514404},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.2502000033855438},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.2500999867916107}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2603.19247","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2603.19247","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"article"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2603.19247","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2603.19247","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"article"},"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/16","score":0.6681274771690369,"display_name":"Peace, Justice and strong institutions"}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Large":[0],"Language":[1],"Models":[2],"(LLMs)":[3],"are":[4,44],"increasingly":[5],"integrated":[6],"into":[7],"high-stakes":[8],"applications,":[9],"making":[10],"robust":[11,182],"safety":[12,21,84,128,183],"guarantees":[13],"a":[14,103,123,178],"central":[15],"practical":[16],"and":[17,35,98],"commercial":[18],"concern.":[19],"Existing":[20],"evaluations":[22],"predominantly":[23],"rely":[24],"on":[25,77],"fixed":[26],"collections":[27],"of":[28,57,147,181],"harmful":[29],"prompts,":[30],"implicitly":[31],"assuming":[32],"non-adaptive":[33],"adversaries":[34],"thereby":[36],"overlooking":[37],"realistic":[38],"attack":[39],"scenarios":[40],"in":[41,107,126,154],"which":[42],"inputs":[43],"iteratively":[45],"refined":[46],"to":[47,61,74,80,93,111,158],"evade":[48],"safeguards.":[49],"In":[50],"this":[51],"work,":[52],"we":[53,88],"examine":[54],"the":[55,108,131,143],"vulnerability":[56],"contemporary":[58],"language":[59,139],"models":[60],"automated,":[62,174],"adversarial":[63],"prompt":[64,69],"refinement.":[65],"We":[66],"repurpose":[67],"black-box":[68],"optimization":[70],"techniques,":[71],"originally":[72],"designed":[73],"improve":[75],"performance":[76],"benign":[78],"tasks,":[79],"systematically":[81],"search":[82],"for":[83,136],"failures.":[85],"Using":[86],"DSPy,":[87],"apply":[89],"three":[90],"such":[91],"optimizers":[92],"prompts":[94],"drawn":[95],"from":[96,152],"HarmfulQA":[97],"JailbreakBench,":[99],"explicitly":[100],"optimizing":[101],"toward":[102],"continuous":[104],"danger":[105,145],"score":[106,146],"range":[109],"0":[110],"1":[112],"provided":[113],"by":[114],"an":[115],"independent":[116],"evaluator":[117],"model":[118],"(GPT-5.1).":[119],"Our":[120],"results":[121],"demonstrate":[122],"substantial":[124],"reduction":[125],"effective":[127],"safeguards,":[129],"with":[130],"effects":[132],"being":[133],"especially":[134],"pronounced":[135],"open-source":[137],"small":[138],"models.":[140],"For":[141],"example,":[142],"average":[144],"Qwen":[148],"3":[149],"8B":[150],"increases":[151],"0.09":[153],"its":[155],"baseline":[156],"setting":[157],"0.79":[159],"after":[160],"optimization.":[161],"These":[162],"findings":[163],"suggest":[164],"that":[165,173],"static":[166],"benchmarks":[167],"may":[168],"underestimate":[169],"residual":[170],"risk,":[171],"indicating":[172],"adaptive":[175],"red-teaming":[176],"is":[177],"necessary":[179],"component":[180],"evaluation.":[184]},"counts_by_year":[],"updated_date":"2026-03-24T06:04:31.470712","created_date":"2026-03-24T00:00:00"}