🤖 machine learning

Persona-Conditioned Adversarial Prompting: Multi-Identity Red-Teaming for Adversarial Discovery and Mitigation

This paper introduces Persona-Conditioned Adversarial Prompting (PCAP), a red-teaming framework that leverages diverse attacker personas to discover transferable jailbreaks and generate rich, metadata-rich datasets, thereby enabling effective automated alignment and significantly improving model robustness through targeted fine-tuning.

Original authors: Cristian Morasso, Anisa Halimi, Muhammad Zaid Hameed, Douglas Leith

Published 2026-05-13

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Cristian Morasso, Anisa Halimi, Muhammad Zaid Hameed, Douglas Leith

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are trying to teach a very smart but naive robot how to spot dangerous tricks. The robot is a Large Language Model (LLM), and right now, it's getting tricked by people who know exactly how to phrase their questions to bypass its safety rules.

The paper introduces a new method called PCAP (Persona-Conditioned Adversarial Prompting). Here is how it works, explained through simple analogies:

The Problem: The "One-Trick Pony" Attackers

Previously, automated systems trying to find these safety holes (called "red-teaming") were like a security guard who only checks for one specific type of lockpick. They would try the same few tricks over and over.

The Result: They found some holes, but they missed the clever, real-world tricks that actual bad actors use. It's like testing a castle's defenses only by trying to climb the front wall, while ignoring the fact that someone could sneak in through the back door disguised as a baker.

The Solution: The "Method Actor" Approach

PCAP changes the game by giving the attacker robot a costume and a script. Instead of just being a generic "hacker," the robot is told to pretend to be specific people (Personas) with specific goals.

The Personas: Imagine the robot puts on different masks. Sometimes it acts like a curious student asking a question for a school project. Sometimes it acts like a grumpy doctor trying to solve a medical mystery. Other times, it acts like a malicious actor trying to cause trouble.
The Strategy Cards: Along with the costume, the robot gets a deck of "Strategy Cards." These are like cheat sheets telling it how to talk. One card might say, "Use a historical story to hide your real intent." Another might say, "Split your question into tiny, harmless pieces."

How It Works: The Parallel Playgrounds

Instead of one robot trying to break the system, PCAP sets up multiple parallel playgrounds.

The Setup: It creates, say, 6 different "actors" (a student, a teacher, a hacker, etc.).
The Search: Each actor tries to trick the target robot using their own unique voice and a specific set of strategies.
The Discovery: Because they are all trying different things at once, they find a much wider variety of safety holes.
- Analogy: If you want to find every crack in a dam, you don't just throw one rock at it. You throw water, sand, ice, and vines at it from different angles. PCAP throws all these different "materials" at the robot simultaneously.

The Results: Finding More Holes, Faster

The paper tested this on a very strong robot (GPT-OSS 120B).

Before PCAP: The old method found a way to break the safety rules about 57% of the time.
With PCAP: The new method broke through 97% of the time.
Diversity: It didn't just break it more often; it found 2 to 6 times more unique ways to break it. It's like finding 100 different keys instead of just 10.

The Best Part: The "Self-Healing" Loop

This is the most important part of the paper. Usually, finding a hole is just the first step. You then have to hire humans to write a fix, which takes forever.

PCAP automates the fix:

The Attack: The "actors" break the robot and record exactly how they did it.
The Lesson: The paper shows that you can take these recorded tricks and use them to "fine-tune" (re-train) the robot.
The Result: The robot learns to recognize the pattern of the trick, not just the specific words.
- Analogy: Instead of teaching the robot "Don't let in people wearing red hats," you show it a thousand photos of people in red hats, blue hats, and green hats trying to sneak in, and it learns the concept of "sneaking."
The Proof: After this quick re-training, the robot became incredibly tough. It stopped the attacks 99% of the time, with almost no false alarms (it didn't start refusing to answer normal questions).

Summary

The paper presents a complete cycle:

Discover: Use "method actors" to find safety holes that normal tests miss.
Generate: Automatically create a massive dataset of these tricks.
Defend: Use that dataset to instantly teach the robot how to spot and block those tricks.

It turns the process of finding weaknesses and fixing them into a fast, automated loop, making AI safer much faster than before.

Technical Summary: Persona-Conditioned Adversarial Prompting (PCAP)

Problem Statement

Automated red-teaming for Large Language Models (LLMs) currently suffers from two critical limitations: limited attacker diversity and a gap between evaluation and actionable mitigation. Existing automated pipelines often rely on narrow sets of tactics (e.g., fixed templates or direct attacks) and single-shot transformations. Consequently, they fail to capture realistic, complex attack vectors that rely on attacker identity, social engineering, and contextual framing (e.g., role-based trust or domain-specific jargon). This narrow exploration yields insufficient data for robust safety fine-tuning and underestimates real-world risks. Furthermore, while "purple-teaming" approaches exist to close the loop between vulnerability discovery and defense, many lack systematic diversification across attacker identities and explicit strategy conditioning.

Methodology: Persona-Conditioned Adversarial Prompting (PCAP)

The authors introduce PCAP, a framework that extends the Tree of Attacks with Pruning (TAP) algorithm. PCAP conditions adversarial search on diverse attacker personas and explicit strategy sets to explore realistic attack scenarios in a black-box setting.

Core Components

Persona Construction: A persona generator ( $G_p$ ) creates $N$ distinct personas (e.g., curious students, domain experts, malicious actors) with unique demographics, biographical details, and behavioral characteristics.
Goal Reframing: A reframing model ( $R$ ) reinterprets the target harmful goal ( $g$ ) within the context of each persona ( $\pi_i$ ), producing a personalized objective ( $\tilde{g}_i$ ) that embeds the attack intention into the persona's narrative.
Strategy Conditioning: A set of attack strategies ( $\Sigma$ ) is defined (e.g., roleplay, payload-splitting, typos). Each persona is assigned a subset of strategies ( $\Sigma_i$ ). The attacker model ( $A$ ) is conditioned on the persona, the reframed goal, and the specific strategy card, acting as an in-context guide.
Parallelized Adversarial Search: Instead of a single search beam, PCAP instantiates $N$ independent TAP searches running in parallel. Each search maintains its own beam ( $S^{(i)}_t$ ) of width $W$ . At each iteration, the persona-conditioned attacker generates variations, which are filtered by an on-topic checker ( $O$ ), scored by an evaluator ( $E$ ), and pruned to the top- $W$ candidates.
Metadata-Rich Dataset Generation: Crucially, every successful prompt is automatically annotated with its assigned persona, goal, and strategy tags. This creates a rich, annotation-free corpus suitable for training robust refusal behaviors.

Key Contributions

Persona-Conditioned Search: PCAP shifts the focus from modifying the refinement pipeline to changing who the attacker is and how they attack. This modular approach explores diverse linguistic and strategic framings that exploit role-based trust and domain-specific framing.
Comprehensive Empirical Evaluation: The authors evaluate PCAP across multiple attacker models with varying capabilities (Dense and Mixture-of-Experts architectures). They demonstrate consistent improvements in attack success rates (ASR), prompt yield, and transferability against dedicated guardrails.
Practical Closed-Loop Mitigation: The paper demonstrates a complete pipeline from vulnerability discovery to automated defense. By fine-tuning lightweight adapters (ALoRA) on PCAP-generated data, the authors show significant improvements in model robustness without manual annotation.
Open Source Release: The authors commit to releasing the PCAP code integrated with a red-teaming framework upon acceptance.

Experimental Results

Experiments were conducted on GPT-OSS 120B as the target model, using various attacker models (Llama 3.3 70B, Granite 3.3 8B, Granite 4.0 H Tiny, Kimi K2.5, Mixtral 8x22B).

Attack Performance

Attack Success Rate (ASR): PCAP significantly outperforms the baseline TAP. On GPT-OSS 120B, ASR increased from 57.7% to 97.3% (Llama 3.3 70B attacker) and from 41.0% to 98.0% (Granite 4.0 H Tiny attacker).
Prompt Yield: PCAP generates 2–6× more diverse successful prompts per goal compared to TAP. For example, Granite 4.0 H Tiny saw a yield increase from 0.43 to 2.41 prompts/goal.
Transferability: Prompts generated by PCAP showed high transferability, bypassing dedicated guardrails (Granite Guardian 3.3 and Llama Guard 3) at rates of 30–58%. Notably, a significant portion of these prompts bypassed both the target model and the guardrails, indicating the discovery of generalizable semantic vulnerabilities.
Diversity: PCAP prompts exhibited lower semantic similarity (cosine similarity ~0.62–0.67) and lower Self-BLEU scores (0.02–0.08) compared to baselines, confirming high lexical and semantic diversity. Strategy distributions were more balanced (lower $\chi^2$ scores) than TAP, which relied heavily on roleplay.

Mitigation and Robustness

Fine-Tuning: Lightweight ALoRA adapters were fine-tuned on the PCAP-generated dataset (300 prompts across 50 goals).
Performance Gains: Fine-tuning dramatically improved adversarial robustness across three model families (Granite, Llama, Qwen).
- Recall: Improved from 0.26–0.36 to 0.96–1.00.
- F1 Score: Improved from 0.41–0.53 to 0.96–0.98.
- Precision: Maintained high levels (0.94–0.97) with minimal false positives.
Purple-Teaming Validation: When fine-tuned models were re-tested with PCAP, they demonstrated strong resistance. For instance, Granite 3.3 8B saw ASR drop from 100% to 33.7%, and the number of queries required to find a successful jailbreak increased by 5–7×. This confirms the dataset teaches generalizable attack pattern recognition.

Significance and Claims

The paper claims that PCAP provides a complete, automated, closed-loop approach to LLM safety. By conditioning adversarial search on diverse personas, the method discovers vulnerabilities that narrow pipelines miss, specifically those relying on social engineering and identity-based trust.

The authors emphasize that the annotation-free nature of the generated dataset is a key practical advantage, eliminating the cost and scalability issues of human red-teaming. The ability to achieve near-perfect robustness (F1 > 0.96) through lightweight fine-tuning in a few hours (2–9 hours on A100) demonstrates a practical path for continuous model hardening. The work positions PCAP not just as a discovery tool, but as a functional "purple team" that bridges the gap between vulnerability identification and automated, effective defense.