Claudini: Autoresearch Discovers State-of-the-Art Adversarial Attack Algorithms for LLMs

Alexander Panfilov; Peter Romov; Igor Shilov; Yves-Alexandre de Montjoye; Jonas Geiping; Maksym Andriushchenko

cs.LGMar 25, 2026

Claudini: Autoresearch Discovers State-of-the-Art Adversarial Attack Algorithms for LLMs

Authors: Alexander Panfilov, Peter Romov, Igor Shilov, Yves-Alexandre de Montjoye, Jonas Geiping, Maksym Andriushchenko

Organizations: MATS · ELLIS Institute Tübingen & Max Planck Institute for Intelligent Systems · Tübingen AI Center · Imperial College London

Abstract

We show that AI agents are capable of discovering novel algorithms for adversarial attacks against LLMs, advancing the state of the art on white-box jailbreaking and prompt injection evaluations. We deploy frontier agents, such as Claude Code and Codex, in an autoresearch loop with access to a library of 30+ prior methods and an evaluation script with a fixed compute budget. We show this pipeline to be effective in jailbreaking OpenAI's GPT-OSS-Safeguard-20B and in prompt injections against Meta-SecAlign-70B, an adversarially robust model. For GPT-OSS-Safeguard, the best agent-discovered method achieves up to 80% attack success rate on CBRN queries, compared to <50% for existing methods. For SecAlign, it achieves 100% ASR, while the best prior automated methods only achieve 82%. Notably, in our setting, attack methods are developed on unrelated surrogate models for a pure random-target token-forcing task, yet generalize directly to prompt injection on the adversarially trained model. Finally, we trace the lineage of methods developed during autoresearch, characterizing the agents' strategies and failure modes. Adversarial ML has long held that defenses must be evaluated against attacks tailored to them; autoresearch automates this principle, and we argue it should be the minimum bar for defense evaluation going forward.

Figures & tables

Figure 1: (left) Autonomous agents directly improve attack algorithms when targeting a single model : autoresearch against GPT-OSS-Safeguard-20B yields attacks that outperform existing methods on held-out ClearHarm CBRN queries. (middle) Agents find generalizable and transferable attack algorithms : methods discovered on unrelated models (Qwen-2.5-7B, Llama-2-7B, Gemma-7B), on a token-forcing task with randomly sampled targets, transfer to the prompt injection setting against Meta-SecAlign-70B [ 11 ] . (right) Agents outperform all baselines on held-out random targets : on the random token target task, aggregated over five models, Claude-devised attacks outperform existing methods and their Optuna-tuned counterparts.

Figure 2: Claudini Strongly Outperforms a Classical AutoML Method. Optuna (teal): we run Bayesian hyperparameter search independently on each of the 25 prior methods (100 trials per method) and plot the best loss across all of them at each trial. Claude (orange): best loss achieved by Claude-designed optimizer variants (100 trials). Vertical ticks at trials 19 and 64 show where we switched target model during the autoresearch run. Claude methods consistently outperform Optuna-tuned baselines, reaching $10\times$ lower loss by version 82.

Figure 3: Claudini Pipeline. The agent iteratively designs, implements, and evaluates new attacks. It is seeded with a collection of existing attacks and their results (losses). All produced methods are evaluated on held-out targets and, where applicable, held-out models, and placed on a leaderboard. We define a single experiment as a method implemented and evaluated on a set of targets with a given FLOPs and input tokens budget.

Method	Train Loss $\downarrow$	Test Loss $\downarrow$	Test ASR $\uparrow$
I-GCG	0.02	0.91	48%
MAC	0.03	1.02	40%
TAO	0.01	1.23	30%
Opus 4.6
$\hookrightarrow$ Run 1 (v53)	0.30	0.37	75%
$\hookrightarrow$ Run 2 (v100)	0.13	0.23	80%

Table 1: Autoresearch against GPT-OSS-Safeguard-20B. All methods are optimized on a single harmful query and evaluated on 40 held-out CBRN queries from ClearHarm. We perform two independent autoresearch runs of 100 iterations each, reporting the method with the highest ASR for each run.

Figure 4: Autoresearch with and without access to prior methods. Best token-forcing loss on Qwen2.5-7B random targets. Solid lines: agents seeded with all 33 baseline methods and their results, starting from I-GCG+LSGM (the strongest baseline). Dashed lines: agents seeded with only GCG, but with internet access. Access to the local library substantially helps Opus 4.6, reducing best loss from 2.12 (GCG-only) to 0.12 (full library). Notably, in the GCG-only run, Opus 4.6 discovered the Probe Sampling attack [ 62 ] online and downloaded Qwen2.5-0.5B as a surrogate model, while GPT-5.5 remained stuck tuning vanilla GCG hyperparameters.

Method	Train Loss $\downarrow$	Test Loss $\downarrow$
Opus 4.6
$\hookrightarrow$ v15	0.54 ± $0.620\,829\,469\,126\,851\,4\text{\,}$	0.62 ± $0.783\,558\,443\,240\,076\,2\text{\,}$
$\hookrightarrow$ v82	0.12 ± $0.177\,616\,607\,089\,548\,88\text{\,}$	0.26 ± $0.390\,416\,447\,596\,584\,67\text{\,}$
GPT-5.5
$\hookrightarrow$ v13	0.09 ± $0.153\,103\,421\,277\,393\,93\text{\,}$	0.04 ± $0.086\,937\,657\,598\,815\,93\text{\,}$
$\hookrightarrow$ v78	1.06 ± $0.364\,414\,395\,383\,195\,6\text{\,}$	2.10 ± $1.449\,050\,456\,760\,650\,8\text{\,}$

Table 2: Agents Ablation. Comparison of autoresearch agents on the random-targets for Qwen-2.5-7B-Instruct. For each agent we report the version with the lowest training loss. All numbers are mean

\pm

std of token-forcing loss; lower is better.

Figure 5: Attack Success Rates on Meta-SecAlign. Prompt injection attack success rates on 50 held-out AlpacaFarm instructions, where the attacker forces the model to output “Hacked” via an optimized suffix in the untrusted input role. We evaluate with a

10^{17}

FLOPs budget on the 8B model and

10^{18}

FLOPs on the 70B model. Agent-designed methods outperform all baselines including Optuna-tuned variants on both model scales, achieving perfect (100%) ASR on Meta-SecAlign-70B.

Method	HP#	Loss	Description
v1	1	5.241	GCG + multi-restart, ACG schedules, LSGM, gradient momentum, patience
v3	1	4.150	Single-restart GCG + LSGM + gradient momentum
v6 $\to$ v15	7	0.539	ADC + LSGM gradient scaling on norm layers
v9	0	8.663	PGD + LSGM gradient scaling on norm layers
v11 $\to$ v18	1	1.513	ADC + LSGM + LILA (auxiliary loss on intermediate activations)
v19 $\to$ v22	3	9.113	ADC + sum-loss $\mathcal{L}\!=\!\sum_{i}\ell_{i}$ (decouples $K$ from lr)

Table 3: A subset of Claude-designed attack variants from the random-target run against Qwen2.5-7B (124 versions; see Figure 7 (b) for the full lineage). HP# is the number of hyperparameter-only variants of that method; an arrow marks the best one when HP-tuning improves the loss. Loss reports the best loss across these variants, averaged over random seeds (bold marks a new record).

Appendix figures & tables8 assets

Supplementary material from the paper’s appendix.

Appendix

Method	Type	Year	Has safety-specific components?
UAT [ 55 ]	D	2019	No
AutoPrompt [ 51 ]	D	2020	No
GBDA [ 17 ]	C	2021	No
ARCA [ 26 ]	D	2023	No
PEZ [ 58 ]	C	2023	No
GCG [ 63 ]	D	2023	No

Appendix

Table 4: Methods included in our evaluation. Type : D = discrete, C = continuous relaxation, F = gradient-free. Safety-specific indicates whether the original method contains components designed specifically for jailbreaking or safety-bypass scenarios (e.g., refusal-suppression losses, judge-based rewards, fluency constraints, first-token weighting). See below for detailed adaptation notes.

Method	Qwen-2.5-7B	Llama-2-7B	Gemma-7B	Gemma-2-2B	Llama-3-8B	Avg $\downarrow$
I-GCG-LSGM	4.05 ± $1.04\text{\,}$	3.41 ± $0.92\text{\,}$	4.38 ± $2.55\text{\,}$	2.15 ± $1.01\text{\,}$	2.15 ± $1.12\text{\,}$	3.23
TAO	5.16 ± $1.86\text{\,}$	3.84 ± $1.28\text{\,}$	2.93 ± $2.10\text{\,}$	1.51 ± $1.02\text{\,}$	2.88 ± $1.37\text{\,}$	3.26
I-GCG	4.04 ± $1.50\text{\,}$	3.69 ± $1.27\text{\,}$	4.89 ± $2.26\text{\,}$	2.05 ± $1.31\text{\,}$	2.44 ± $1.05\text{\,}$	3.43
AttnGCG	6.11 ± $1.29\text{\,}$	3.96 ± $1.34\text{\,}$	3.59 ± $2.03\text{\,}$	1.76 ± $1.08\text{\,}$	3.37 ± $0.92\text{\,}$	3.76
MAC	6.18 ± $1.35\text{\,}$	3.42 ± $1.13\text{\,}$	4.54 ± $2.92\text{\,}$	1.94 ± $1.16\text{\,}$	3.17 ± $0.96\text{\,}$	3.85
MC-GCG	6.58 ± $1.52\text{\,}$	3.56 ± $1.01\text{\,}$	4.23 ± $2.32\text{\,}$	1.87 ± $1.09\text{\,}$	3.17 ± $0.95\text{\,}$	3.88

Appendix

Table 5: Mean validation loss on held-out random targets (

10^{17}

FLOPs budget). Targets are never seen during attack development. Gemma-2-2B and Llama-3 are held-out models not used during the autoresearch runs. Of 25 Optuna-tuned methods, we evaluate the 12 top-performing configurations on validation targets. Of

{\sim}

100 Claude versions, we evaluate those on the training loss frontier plus claude_v63 (which narrowly misses the frontier but excels on SecAlign). Standard deviations are shown as subscripts. Highlighted : best in column across all methods. claude_v53 and claude_v82 are tied for the lowest average loss. Methods are sorted by average loss over all available models.

Figure 6: Median rank vs. mean loss on held-out targets aggregated over all five models (Qwen-2.5-7B, Llama-2-7B, Gemma-7B, Gemma-2-2B, Llama-3-8B). Gemma-2-2B and Llama-3-8B are held-out models not used during autoresearch. Claude-designed methods (orange stars) dominate the bottom-left corner, achieving both lower rank and lower loss than existing attacks and their Optuna-tuned counterparts.

Panel of Figure 7 — Figure 7: Evolution of Claude-Designed Attacks. Blue boxes denote structural innovations; dashed orange boxes denote hyperparameter (HP) tuning rounds. Dead-end innovations listed in Tables 6 and 3 are omitted for clarity. Red regions in (a) mark variants reward-hacking the train loss († in Table 6 ), e.g. optimizing random initialization or re-using the best suffix from the previous runs circumventing the FLOPs budget.

Method	HP#	Loss	Description
v1 $\to$ v5	1	4.563	I-GCG (GCG + LSGM gradient scaling)
v3	1	5.063	ADC continuous relaxation (SGD on soft token logits)
v4	0	5.313	ACG + LSGM gradient scaling on norm layers
v6	0	4.219	TAO-Attack: DPTO directional candidate scoring
v7	0	4.188	MAC: momentum-assisted candidate selection
v8 $\to$ v11	6	1.836	MAC + TAO merge: gradient momentum EMA with DPTO candidate scoring

Appendix

Table 6: A subset of Claude-designed optimizer variants from Run 1 of the GPT-OSS-Safeguard-20B autoresearch run (189 versions; see Figure 7 (a) for the full lineage). † denote reward-hacking strategies. HP# shows hyperparameter-only variants derived from that method; when hp-tuning improves the loss, the best variant is shown with an arrow. Loss is the best loss across the method’s HP variants (averaged over random seeds, bold when a new record is set).

Candidates	$B$	$=\mathbf{80}$	TAO default $=256$
Cosine filter size	$k$	$=\mathbf{300}$	TAO default $=256$
Temperature	$\tau$	$=\mathbf{0.4}$	TAO default $=0.5$
Momentum	$\mu$	$=\mathbf{0.908}$	MAC default $=0.4$
Switch fraction	$f$	$=\mathbf{0.8}$
Estimated total steps	$N$	$=\mathbf{131}$
Replacements schedule	$n_{\mathrm{rep}}(\text{step})$	$=\mathbf{2}$ for first $\mathbf{80\%}$ of steps, then $\mathbf{1}$	GCG default $=1$

Appendix

Algorithm 1 (Safeguard Attack) claude_oss_v53 : MAC [ 61 ] + TAO [ 59 ] + Coarse-to-Fine.

Per-position top- $k$	$K_{\mathrm{tok}}$	$=\mathbf{384}$	GCG default $=256$
Merge depth	$K$	$=\mathbf{7}$
Phase-1 fraction	$f_{1}$	$=\mathbf{0.10}$
Cycle fraction	$f_{c}$	$=\mathbf{0.03}$
Search width schedule	$W(\rho)$	$=\mathbf{768\!\to\!512\!\to\!384}$ at $\rho\in\{0.40,0.75\}$	GCG default $=512$
Perturbation schedule	$P(\rho)$	$=\mathbf{5\!\to\!3\!\to\!1}$ at $\rho\in\{0.50,0.80\}$

Appendix

Algorithm 2 (Safeguard Attack) claude_oss2_v100 : MC-GCG [ 25 ] + ILS [ 34 ] .

		claude_v63	kimi_v45
Momentum	$\beta$	$=0.99$		ADC default $=0.99$
EMA rate	$\alpha$	$=0.01$		ADC default $=0.01$
Restarts	$K$	$=\mathbf{6}$	$=\mathbf{8}$	ADC default $=16$
Learning rate	$\eta$	$=\mathbf{10}$	$=\mathbf{220}$	ADC default $=160$
LSGM scale	$\gamma$	$=\mathbf{0.85}$	$=\mathbf{0.70}$	I-GCG default $=0.5$
Loss coefficient	$a_{K}$	$=\mathbf{1}$	$=1/K$	ADC default $=1/K$

Appendix

Algorithm 3 (Generalizable Attack) claude_v63 / kimi_v45 : ADC [ 22 ] + LSGM [ 31 ] .

Adversarial Attacks on LLMs

Adversarial attacks on large language models probe how crafted inputs, internal changes, and agent interactions bypass safety or disrupt reliable behavior.

See all 355 papers

Meta-SecAlign: Training LLMs against Prompt Injection for Robust Agents
Jul 3, 2025Sizhe Chen, Arman Zharmagambetov, David Wagner +1LLM Agent Security AI Agent Security Benchmarks
FAIR at Meta · UC Berkeley
Automated jailbreak attack targeting multiple defense strategies
Jun 15, 2026Qi Wang, Chengcheng Wan, Weijia He +4Adversarial Prompt Generation LLM Jailbreak Attacks
East China Normal University Shanghai, China · East China Normal University, Shanghai Innovation Institute Shanghai, China · University of Southampton Southampton, England +2
Adaptive Adversaries: A Multi-Turn, Multi-LLM Benchmark for LLM Agent Security
Jul 20, 2026Devina Jain, David Hartmann, Chuan LiAdversarial Attacks on LLMs LLM Agent Evaluation
Lambda

Jul 3, 2025J/K move · Enter open · S save

Meta-SecAlign: Training LLMs against Prompt Injection for Robust Agents

Sizhe Chen, Arman Zharmagambetov, David Wagner, Chuan Guo

FAIR at Meta · UC Berkeley

LLM Agent Security AI Agent Security Benchmarks Prompt Injection Defense Adversarial Robustness of Language Models Prompt Injection Attacks on LLMs LLM Agent Training+1

Open paper AskPDF arXiv

Prompt injection attacks, where untrusted data contains an injected prompt to manipulate the system, have been listed as the top security threat to AI agents. By fine-tuning on simulated prompt injections, SecAlign, a leading open defense, reports LLMs with good test-time robustness and negligible benign utility drop. By scaling up training and evaluations, however, we find that SecAlign actually suffers from significant utility degradation, especially in agentic tasks where the threat of prompt injection is prominent. Motivated by this, we propose Meta-SecAlign for utility-preserving defense by (1) randomized injection position during training to avoid shortcut learning and (2) self-generated responses as high-quality in-distribution training labels. Across general knowledge, instruction following, and agentic workflows (on tool-calling and web-navigation), Meta-SecAlign maintains almost all the undefended LLM's utility while achieving better overall security than SecAlign against various static and GCG adaptive attacks. Experiments use Llama-3.1-8B, Llama-3.3-70B, Llama-4-Scout, Qwen3-4B, and Qwen3.6-27B on 6 prompt injection benchmarks including AgentDojo, InjecAgent, WASP, and SEP. Below are links for the code (https://github.com/facebookresearch/Meta_SecAlign), Meta-SecAlign-70B (https://huggingface.co/facebook/Meta-SecAlign-70B), and Meta-SecAlign-8B (https://huggingface.co/facebook/Meta-SecAlign-8B) models.

Abstract

Adversarial Attacks on LLMs

Explore similar work

Meta-SecAlign: Training LLMs against Prompt Injection for Robust Agents

Automated jailbreak attack targeting multiple defense strategies

Adaptive Adversaries: A Multi-Turn, Multi-LLM Benchmark for LLM Agent Security