Adaptive Adversaries: A Multi-Turn, Multi-LLM Benchmark for LLM Agent Security

How do modern LLM-based agents perform when subjected to adaptive, multi-turn adversarial attacks? Current safety benchmarks often rely on static, pre-collected attack pools, which fail to capture how an attacker might pivot their strategy based on a defender's responses. This paper addresses the gap in evaluating LLM security against dynamic, multi-round manipulation.

The authors developed a benchmark consisting of 21 scenarios where an autonomous LLM attacker interacts with a memoryless LLM defender over 15 rounds. The attacker observes the defender's previous responses to refine its strategy, while the defender is evaluated as a fresh interaction each round. The researchers used a 3x3 matrix of frontier LLMs (Claude Opus 4.6, GPT-5.4, and Gemini 2.5 Pro) to evaluate performance and released a comprehensive dataset including 945 transcripts and over 18,000 competition battles to calibrate the benchmark.

The study finds that multi-turn, adaptive attacks are significantly more effective than single-turn attempts, with attack success rates (ASR) jumping from near 0% to as high as 14% when 15 rounds of adaptation are allowed. Crucially, while top-tier models like Claude Opus 4.6 and GPT-5.4 may appear tied in aggregate performance, they possess sharply different vulnerabilities. For example, Opus was highly susceptible to a specific role-frame conflict in a memory-leak scenario, whereas other models remained robust. Furthermore, the researchers found that pooling multiple attacker LLMs uncovers significantly more unique successful attacks than relying on a single attacker, suggesting that different models employ distinct adversarial strategies.