arXiv 2605.100672026-05-21cs.LGcs.AI

Metis: 通过自进化元认知策略优化学习 jailbreak LLMs

Metis: Learning to Jailbreak LLMs via Self-Evolving Metacognitive Policy Optimization

University of Science and Technology of China（中国科学技术大学）；Institute of Artificial Intelligence (TeleAI), China Telecom（人工智能研究院（TeleAI），中国电信）

Huilin Zhou, Jian Zhao, Yilu Zhong, Zhen Liang, Xiuyuan Chen, Yuchen Yuan, Tianle Zhang, Chi Zhang, Lan Zhang, Xuelong Li

备注：: Accepted to the 43rd International Conference on Machine Learning (ICML 2026)

阅读 PDF

arXiv 页面 ↗HTML 原文 ↗

AI总结：

本文提出Metis框架，通过将jailbreaking重新表述为对抗性部分可观测马尔可夫决策过程中的推理时间策略优化，以提高对抗性测试的效率和效果，同时通过结构化反馈和透明推理轨迹提升可解释性，实验表明Metis在多种模型上均表现出更高的攻击成功率和更低的token成本。

摘要：

红队测试对于揭示大型语言模型（LLMs）中的漏洞至关重要。尽管自动化方法已提高可扩展性，但现有方法往往依赖静态启发式或随机搜索，使其在面对高级安全对齐时显得脆弱。为了解决这一问题，我们引入了Metis框架，该框架将jailbreaking重新表述为对抗性部分可观测马尔可夫决策过程（POMDP）中的推理时间策略优化。Metis采用自进化元认知循环来执行目标防御逻辑的因果诊断，并利用结构化反馈作为语义梯度来优化其策略，通过透明推理轨迹提高可解释性。在10种不同模型上的广泛评估表明，Metis在比较方法中实现了最强的平均攻击成功率（ASR）为89.2%，在坚韧的前沿模型（如O1和GPT-5-chat）上保持高效果，而传统基线方法表现出显著的性能下降。通过用定向优化替代冗余探索，Metis将token成本平均降低了8.2倍，最高可达11.4倍。我们的分析表明，当前防御在测试设置下仍易受内部引导的闭环推理轨迹影响，突显了下一代防御机制在推理过程中动态处理安全性的关键需求。

英文摘要：

Red teaming is critical for uncovering vulnerabilities in Large Language Models (LLMs). While automated methods have improved scalability, existing approaches often rely on static heuristics or stochastic search, rendering them brittle against advanced safety alignment. To address this, we introduce Metis, a framework that reformulates jailbreaking as inference-time policy optimization within an adversarial Partially Observable Markov Decision Process (POMDP). Metis employs a self-evolving metacognitive loop to perform causal diagnosis of a target's defense logic and leverages structured feedback as a semantic gradient to refine its policy, offering enhanced interpretability through transparent reasoning traces. Extensive evaluations across 10 diverse models demonstrate that Metis achieves the strongest average Attack Success Rate (ASR) among compared methods at 89.2%, maintaining high efficacy on resilient frontier models (e.g., 76.0% on O1 and 78.0% on GPT-5-chat) where traditional baselines exhibit substantial performance degradation. By replacing redundant exploration with directed optimization, Metis reduces token costs by an average of 8.2x and up to 11.4x. Our analysis reveals that current defenses remain vulnerable to internally-steered, closed-loop reasoning trajectories under the tested settings, highlighting a critical need for next-generation defenses capable of reasoning about safety dynamically during inference.

机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。