一句话：提出 MazeBreaker，用多智能体强化学习从攻击反馈中动态学习，实现无需参考预言机的 LLM 越狱。
随着大语言模型广泛应用，其安全性备受关注。现有越狱攻击多依赖模型内部信息，或难以有效探索不安全行为，缺乏自适应与泛化能力。受老鼠逃出迷宫启发，本文提出 MazeBreaker：首个通过多智能体强化学习系统地从目标 LLM 的攻击尝试反馈中学习，并在无参考预言机条件下策略性探索模型安全边界的越狱方法。作者在 13 个开源与商用模型架构上与 6 种先进越狱方法对比。结果表明，该方法攻击效果突出，尤其对安全对齐较强的商用模型（GPT-3.5-turbo、GPT-4o-mini、GLM-4-air、Claude-3.5-sonnet）表现优异，有助于测试 LLM 安全性并推动安全与伦理规范。代码与数据已开源。
In recent years, the application of Large Language Models (LLMs) has become increasingly widespread, along with growing concerns about their security. To assess the security of LLMs, researchers have proposed various jailbreak attack algorithms, but only rely on the models’ internal information or face limitations in exploring the unsafe behavior, highlighting the need for a more adaptive and generalizable approach. Inspired by the game of rats escaping a maze, we introduce a novel jailbreak attack approach, MazeBreaker, where attackers dynamically learn to find the exit based on feedback and their accumulated experience to compromise the target LLMs’ security defenses. Our method is the first to systematically learn from the feedback of attack attempts on target LLMs through a multi-agent reinforcement learning system, enabling strategic exploration of the model’s unsafe boundaries without a reference oracle. We compared our approach with six state-of-the-art jailbreak attack methods, testing it on 13 different architectures of open-source and commercial models. The results show that our method performs exceptionally well in terms of attack effectiveness, especially for the commercial models (GPT-3.5-turbo, GPT-4o-mini, GLM-4-air, and Claude-3.5-sonnet) with strong safety alignment. We hope this study will help academia and industry better test the security of large language models and promote adherence to safety and ethical standards. Code and data are available on our repository: https://github.com/SMAT-Lab/MazeBreaker .
@inproceedings{paperbot11681,
title = {MazeBreaker: Multi-Agent Reinforcement Learning for Dynamic Jailbreaking of LLM Security Defenses},
author = {Zhihao Lin and Wei Ma and Mingyi Zhou and Yanjie Zhao and Haoyu Wang and Yang Liu and Jun Wang and Li Li},
booktitle = {ICSE},
year = {2026},
doi = {10.1145/3744916.3764558}
}