RvB: Automating AI System Hardening via Iterative Red-Blue Games
On the map: LLM safety and security → Prompt injection and agent security
Abstract (arXiv)
The dual offensive and defensive utility of Large Language Models (LLMs) highlights a critical gap in AI security: the lack of unified frameworks for dynamic, iterative adversarial adaptation hardening. To bridge this gap, we propose the Red Team vs. Blue Team (RvB) framework, formulated as a training-free, sequential, imperfect-information game. In this process, the Red Team exposes vulnerabilities, driving the Blue Team to learning effective solutions without parameter updates. We validate our framework across two challenging domains: dynamic code hardening against CVEs and guardrail optimization against jailbreaks. Our empirical results show that this interaction compels the Blue Team to learn fundamental defensive principles, leading to robust remediations that are not merely overfitted to specific exploits. RvB achieves Defense Success Rates of 90% and 45% across the respective tasks while maintaining near 0% False Positive Rates, significantly surpassing baselines. This work establishes the iterative adversarial interaction framework as a practical paradigm that automates the continuous hardening of AI systems.
Key facts. Cited by 2 papers in the map (data through 7 Oct 2026). Placed in Prompt injection and agent security, one of 12 directions in LLM safety and security. Builds on 20 of its 39 references that are in the map. First posted on arXiv 27 Jan 2026.
Builds on
20 of 39 references.
Closest ancestors · 3
Same direction, newest first
- 2025Exposing Weak Links in Multi-Agent Systems under Adversarial Prompting14 Nov
- 2025CoP: Agentic Red-teaming for Large Language Models using Composition of Principles1 Jun
- 2025Red-Teaming LLM Multi-Agent Systems via Communication Attacks20 Feb
Other references · 17
- 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 2,914
- 2023NeMo Guardrails: A Toolkit for Controllable and Safe LLM Applications with Programmable Railscited by 347
- 2024Robust Prompt Optimization for Defending Language Models Against Jailbreaking Attackscited by 150
- 2024AutoDefense: Multi-Agent LLM Defense against Jailbreak Attackscited by 135
- 2024MAGIS: LLM-Based Multi-Agent Framework for GitHub Issue Resolutioncited by 132
- 2023InferFix: End-to-End Program Repair with LLMscited by 113
- 2025X-Teaming: Multi-Turn Jailbreaks and Defenses with Adaptive Multi-Agentscited by 112
- 2023PentestGPT: An LLM-empowered Automatic Penetration Testing Toolcited by 94
- 2024Self-Organized Agents: A LLM Multi-Agent Framework toward Ultra Large-Scale Code Generation and Optimizationcited by 84
- 2024PentestAgent: Incorporating LLM Agents to Automated Penetration Testingcited by 46
- 2025Reasoning-to-Defend: Safety-Aware Reasoning Can Defend Large Language Models from Jailbreakingcited by 34
- 2025DynaGuard: A Dynamic Guardian Model With User-Defined Policiescited by 16
5 more
- 2025Large Language Models are Autonomous Cyber Defenderscited by 14
- 2025X-Guard: Multilingual Guard Agent for Content Moderationcited by 13
- 2025Enhancing Model Defense Against Jailbreaks with Proactive Safety Reasoningcited by 11
- 2025Understanding LLM Agent Behaviours via Game Theory: Strategy Recognition, Biases and Multi-Agent Dynamicscited by 11
- 2025AutoPentest: Enhancing Vulnerability Management With Autonomous LLM Agentscited by 8
Built on by
Citing papers per year: 2026: 2.
2 papers.