FERRET: Framework for Expansion Reliant Red Teaming
On the map: LLM safety and security → Prompt injection and agent security
Abstract (arXiv)
We introduce a multi-faceted automated red teaming framework in which the goal is to generate multi-modal adversarial conversations that would break a target model and introduce various expansions that would result in more effective and efficient adversarial conversations. The introduced expansions include: 1. Horizontal expansion in which the goal is for the red team model to self-improve and generate more effective conversation starters that would shape a conversation. 2. Vertical expansion in which the goal is to take these conversation starters that are discovered in the horizontal expansion phase and expand them into effective multi-modal conversations and 3. Meta expansion in which the goal is for the red team model to discover more effective multi-modal attack strategies during the course of a conversation. We call our framework FERRET (Framework for Expansion Reliant Red Teaming) and compare it with various existing automated red teaming approaches. In our experiments, we demonstrate the effectiveness of FERRET in generating effective multi-modal adversarial conversations and its superior performance against existing state of the art approaches.
Key facts. Cited by 1 paper in the map (data through 14 Oct 2026). Placed in Prompt injection and agent security, one of 12 directions in LLM safety and security. Builds on 16 of its 16 references that are in the map. First posted on arXiv 17 Feb 2026.
Builds on
16 of 16 references.
Closest ancestors · 7
Same direction, newest first
- 2025Strategize Globally, Adapt Locally: A Multi-Turn Red Teaming Agent with Dual-Level Learning2 Apr
- 2024Automated Red Teaming with GOAT: the Generative Offensive Agent Tester2 Oct
- 2024HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusal6 Feb
- 2024Gradient-Based Language Model Red Teaming30 Jan
- 2023MART: Improving LLM Safety with Multi-round Automatic Red-Teaming13 Nov
- 2023Explore, Establish, Exploit: Red Teaming Language Models from Scratch15 Jun
- 2022Red Teaming Language Models with Language Models7 Feb
Other references · 9
- 2021Learning Transferable Visual Models From Natural Language Supervisioncited by 33,744
- 2023Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversationscited by 1,207
- 2024Great, Now Write an Article About That: The Crescendo Multi-Turn LLM Jailbreak Attackcited by 390
- 2023Jailbreak in pieces: Compositional Adversarial Attacks on Multi-Modal Language Modelscited by 273
- 2024Llama Guard 3 Vision: Safeguarding Human-AI Image Understanding Conversationscited by 129
- 2023FLIRT: Feedback Loop In-context Red Teamingcited by 83
- 2025DRAMA: Diverse Augmentation from Large Language Models to Smaller Dense Retrieverscited by 19
- 2024Emerging Vulnerabilities in Frontier Models: Multi-Turn Jailbreak Attackscited by 16
- 2025Red-Teaming Text-to-Image Systems by Rule-based Preference Modelingcited by 8
Built on by
Citing papers per year: 2026: 1.
1 paper.
Similar, not cited
Close in wording, no citation either way
- 2024Ferret: Faster and Effective Automated Red Teaming with Reward-Based Scoring Technique
- 2026OpenRT: An Open-Source Red Teaming Framework for Multimodal LLMs
- 2024Automated Progressive Red Teaming
- 2025RedTWIZ: Diverse LLM Red Teaming via Adaptive Attack Planning
- 2026Training a General Purpose Automated Red Teaming Model
- 2026AdversaBench: Automated LLM Red-Teaming with Multi-Judge Confirmation and Cross-Model Transferability
- 2025Jailbreak-Zero: A Path to Pareto Optimal Red Teaming for Large Language Models
- 2024Holistic Automated Red Teaming for Large Language Models through Top-Down Test Case Generation and Multi-turn Interaction