Track papers across labs, topics, and trends.
Search papers, labs, and topics across Lattice.
This paper introduces Co-Evolutionary Multi-Modal Alignment (CEMMA), a framework for enhancing the safety alignment of multimodal models by dynamically evolving adversarial attacks. CEMMA employs an Evolutionary Attacker that uses genetic operators to generate complex jailbreaks from simpler seeds, and an Adaptive Defender that iteratively trains on these synthesized hard negatives. Experiments demonstrate that CEMMA significantly improves attack success rates in red-teaming and enhances model robustness and generalization, while maintaining benign utility and compatibility with inference-time defenses.
Forget static defenses: CEMMA's co-evolutionary approach uses genetic algorithms to evolve jailbreaking attacks, creating a constantly adapting red-teaming strategy that significantly boosts attack success rates and strengthens model robustness.
Adversarial behavior plays a central role in aligning large language models with human values. However, existing alignment methods largely rely on static adversarial settings, which fundamentally limit robustness, particularly in multimodal settings with a larger attack surface. In this work, we move beyond static adversarial supervision and introduce co-evolutionary alignment with evolving attacks, instantiated by CEMMA (Co-Evolutionary Multi-Modal Alignment), an automated and adaptive framework for multimodal safety alignment. We introduce an Evolutionary Attacker that decomposes adversarial prompts into method templates and harmful intents. By employing genetic operators, including mutation, crossover, and differential evolution, it enables simple seed attacks to inherit the structural efficacy of sophisticated jailbreaks. The Adaptive Defender is iteratively updated on the synthesized hard negatives, forming a closed-loop process that adapts alignment to evolving attacks. Experiments show that the Evolutionary Attacker substantially increases red-teaming jailbreak attack success rate (ASR), while the Adaptive Defender improves robustness and generalization across benchmarks with higher data efficiency, without inducing excessive benign refusal, and remains compatible with inference-time defenses such as AdaShield.