{"id":"https://openalex.org/W7160906384","doi":"https://doi.org/10.48550/arxiv.2605.10067","title":"Metis: Learning to Jailbreak LLMs via Self-Evolving Metacognitive Policy Optimization","display_name":"Metis: Learning to Jailbreak LLMs via Self-Evolving Metacognitive Policy Optimization","publication_year":2026,"publication_date":"2026-05-11","ids":{"openalex":"https://openalex.org/W7160906384","doi":"https://doi.org/10.48550/arxiv.2605.10067"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2605.10067","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2605.10067","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2605.10067","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5135993376","display_name":"Huilin Zhou","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Zhou, Huilin","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5135932186","display_name":"Jian Zhao","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Zhao, Jian","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5135975830","display_name":"Yilu Zhong","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Zhong, Yilu","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5135943368","display_name":"Zhen Liang","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Liang, Zhen","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5135944361","display_name":"Xiuyuan Chen","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Chen, Xiuyuan","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5135944071","display_name":"Yuchen Yuan","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Yuan, Yuchen","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5135946674","display_name":"Tianle Zhang","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Zhang, Tianle","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5135945836","display_name":"Chi Zhang","orcid":"https://orcid.org/0009-0008-5580-1338"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Zhang, Chi","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5135932181","display_name":"Lan Zhang","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Zhang, Lan","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5135955214","display_name":"Xuelong Li","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Li, Xuelong","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.923799991607666,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.923799991607666,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10028","display_name":"Topic Modeling","score":0.013299999758601189,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12026","display_name":"Explainable Artificial Intelligence (XAI)","score":0.009100000374019146,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/metis","display_name":"Metis","score":0.7445999979972839},{"id":"https://openalex.org/keywords/interpretability","display_name":"Interpretability","score":0.6424000263214111},{"id":"https://openalex.org/keywords/heuristics","display_name":"Heuristics","score":0.5870000123977661},{"id":"https://openalex.org/keywords/visual-reasoning","display_name":"Visual reasoning","score":0.4503999948501587},{"id":"https://openalex.org/keywords/metacognition","display_name":"Metacognition","score":0.4196000099182129},{"id":"https://openalex.org/keywords/markov-decision-process","display_name":"Markov decision process","score":0.3856000006198883},{"id":"https://openalex.org/keywords/adversarial-system","display_name":"Adversarial system","score":0.3734999895095825},{"id":"https://openalex.org/keywords/process","display_name":"Process (computing)","score":0.3693000078201294},{"id":"https://openalex.org/keywords/markov-process","display_name":"Markov process","score":0.36719998717308044}],"concepts":[{"id":"https://openalex.org/C2780705272","wikidata":"https://www.wikidata.org/wiki/Q19903554","display_name":"Metis","level":2,"score":0.7445999979972839},{"id":"https://openalex.org/C2781067378","wikidata":"https://www.wikidata.org/wiki/Q17027399","display_name":"Interpretability","level":2,"score":0.6424000263214111},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6146000027656555},{"id":"https://openalex.org/C127705205","wikidata":"https://www.wikidata.org/wiki/Q5748245","display_name":"Heuristics","level":2,"score":0.5870000123977661},{"id":"https://openalex.org/C2777508537","wikidata":"https://www.wikidata.org/wiki/Q7936620","display_name":"Visual reasoning","level":2,"score":0.4503999948501587},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.42570000886917114},{"id":"https://openalex.org/C118147538","wikidata":"https://www.wikidata.org/wiki/Q1126970","display_name":"Metacognition","level":3,"score":0.4196000099182129},{"id":"https://openalex.org/C106189395","wikidata":"https://www.wikidata.org/wiki/Q176789","display_name":"Markov decision process","level":3,"score":0.3856000006198883},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.37560001015663147},{"id":"https://openalex.org/C37736160","wikidata":"https://www.wikidata.org/wiki/Q1801315","display_name":"Adversarial system","level":2,"score":0.3734999895095825},{"id":"https://openalex.org/C98045186","wikidata":"https://www.wikidata.org/wiki/Q205663","display_name":"Process (computing)","level":2,"score":0.3693000078201294},{"id":"https://openalex.org/C159886148","wikidata":"https://www.wikidata.org/wiki/Q176645","display_name":"Markov process","level":2,"score":0.36719998717308044},{"id":"https://openalex.org/C2779458634","wikidata":"https://www.wikidata.org/wiki/Q24963715","display_name":"Debiasing","level":2,"score":0.36149999499320984},{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.3257000148296356},{"id":"https://openalex.org/C169900460","wikidata":"https://www.wikidata.org/wiki/Q2200417","display_name":"Cognition","level":2,"score":0.3253999948501587},{"id":"https://openalex.org/C17098449","wikidata":"https://www.wikidata.org/wiki/Q176814","display_name":"Partially observable Markov decision process","level":4,"score":0.31790000200271606},{"id":"https://openalex.org/C22019652","wikidata":"https://www.wikidata.org/wiki/Q331309","display_name":"Overfitting","level":3,"score":0.2946999967098236},{"id":"https://openalex.org/C108650721","wikidata":"https://www.wikidata.org/wiki/Q1783253","display_name":"Counterfactual thinking","level":2,"score":0.28859999775886536},{"id":"https://openalex.org/C115086926","wikidata":"https://www.wikidata.org/wiki/Q17004651","display_name":"Causal reasoning","level":3,"score":0.2838999927043915},{"id":"https://openalex.org/C539667460","wikidata":"https://www.wikidata.org/wiki/Q2414942","display_name":"Management science","level":1,"score":0.2833000123500824},{"id":"https://openalex.org/C109574028","wikidata":"https://www.wikidata.org/wiki/Q647525","display_name":"Behavioral economics","level":2,"score":0.28200000524520874},{"id":"https://openalex.org/C12713177","wikidata":"https://www.wikidata.org/wiki/Q1900281","display_name":"Perspective (graphical)","level":2,"score":0.2676999866962433},{"id":"https://openalex.org/C184337299","wikidata":"https://www.wikidata.org/wiki/Q1437428","display_name":"Semantics (computer science)","level":2,"score":0.2669999897480011},{"id":"https://openalex.org/C132829578","wikidata":"https://www.wikidata.org/wiki/Q581151","display_name":"Situated","level":2,"score":0.2655999958515167},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.2615000009536743},{"id":"https://openalex.org/C2780148112","wikidata":"https://www.wikidata.org/wiki/Q1432581","display_name":"Proxy (statistics)","level":2,"score":0.25679999589920044},{"id":"https://openalex.org/C2777548347","wikidata":"https://www.wikidata.org/wiki/Q5456937","display_name":"Flagging","level":2,"score":0.25130000710487366}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2605.10067","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2605.10067","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2605.10067","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2605.10067","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/16","score":0.7651876211166382,"display_name":"Peace, Justice and strong institutions"}],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Red":[0],"teaming":[1],"is":[2],"critical":[3,176],"for":[4,178],"uncovering":[5],"vulnerabilities":[6],"in":[7],"Large":[8],"Language":[9],"Models":[10],"(LLMs).":[11],"While":[12],"automated":[13],"methods":[14,112],"have":[15],"improved":[16],"scalability,":[17],"existing":[18],"approaches":[19],"often":[20],"rely":[21],"on":[22,118,124,128],"static":[23],"heuristics":[24],"or":[25],"stochastic":[26],"search,":[27],"rendering":[28],"them":[29],"brittle":[30],"against":[31],"advanced":[32],"safety":[33,185],"alignment.":[34],"To":[35],"address":[36],"this,":[37],"we":[38],"introduce":[39],"Metis,":[40],"a":[41,61,70,79,175],"framework":[42],"that":[43,100,160],"reformulates":[44],"jailbreaking":[45],"as":[46,78],"inference-time":[47],"policy":[48],"optimization":[49],"within":[50],"an":[51,149],"adversarial":[52],"Partially":[53],"Observable":[54],"Markov":[55],"Decision":[56],"Process":[57],"(POMDP).":[58],"Metis":[59,101,144],"employs":[60],"self-evolving":[62],"metacognitive":[63],"loop":[64],"to":[65,82,155,165],"perform":[66],"causal":[67],"diagnosis":[68],"of":[69,151,182],"target's":[71],"defense":[72],"logic":[73],"and":[74,126,153],"leverages":[75],"structured":[76],"feedback":[77],"semantic":[80],"gradient":[81],"refine":[83],"its":[84],"policy,":[85],"offering":[86],"enhanced":[87],"interpretability":[88],"through":[89],"transparent":[90],"reasoning":[91,168,183],"traces.":[92],"Extensive":[93],"evaluations":[94],"across":[95],"10":[96],"diverse":[97],"models":[98,121],"demonstrate":[99],"achieves":[102],"the":[103,171],"strongest":[104],"average":[105,150],"Attack":[106],"Success":[107],"Rate":[108],"(ASR)":[109],"among":[110],"compared":[111],"at":[113],"89.2%,":[114],"maintaining":[115],"high":[116],"efficacy":[117],"resilient":[119],"frontier":[120],"(e.g.,":[122],"76.0%":[123],"O1":[125],"78.0%":[127],"GPT-5-chat)":[129],"where":[130],"traditional":[131],"baselines":[132],"exhibit":[133],"substantial":[134],"performance":[135],"degradation.":[136],"By":[137],"replacing":[138],"redundant":[139],"exploration":[140],"with":[141],"directed":[142],"optimization,":[143],"reduces":[145],"token":[146],"costs":[147],"by":[148],"8.2x":[152],"up":[154],"11.4x.":[156],"Our":[157],"analysis":[158],"reveals":[159],"current":[161],"defenses":[162,180],"remain":[163],"vulnerable":[164],"internally-steered,":[166],"closed-loop":[167],"trajectories":[169],"under":[170],"tested":[172],"settings,":[173],"highlighting":[174],"need":[177],"next-generation":[179],"capable":[181],"about":[184],"dynamically":[186],"during":[187],"inference.":[188]},"counts_by_year":[],"updated_date":"2026-07-28T07:46:37.118299","created_date":"2026-05-13T00:00:00"}