🤖 AI

Automatic Hard Example Synthesis with Multi-Level Agentic Data Curation

This paper proposes an automated, multi-agent red-teaming framework that synthesizes challenging adversarial examples through iterative hypothesis generation and mutation to significantly enhance multimodal large language model robustness against safety violations without requiring human labeling.

Original authors: Genglin Liu, Muye Zhang, Krishnamurthy Viswanathan, Nichole J. Hansen, Blaž Bratanič, Nathan L Clement, Shalini Ghosh, Ariel Fuxman

Published 2026-07-17

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Genglin Liu, Muye Zhang, Krishnamurthy Viswanathan, Nichole J. Hansen, Blaž Bratanič, Nathan L Clement, Shalini Ghosh, Ariel Fuxman

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are teaching a super-smart robot how to spot dangerous or inappropriate pictures on the internet. This robot is a "Multimodal Large Language Model" (MLLM), which means it can look at an image and read text at the same time to decide if something is safe. But here's the tricky part: bad actors are constantly trying to trick this robot. They create sneaky, weird, or confusing images that look safe at first glance but actually break the rules. This is like a game of hide-and-seek where the "hiders" are getting better at blending in.

To teach the robot, we usually need to show it examples of what not to do. But finding these tricky examples is hard. If you ask a human to draw every possible way to trick the robot, they would get tired long before the robot learned everything. This is where "Active Learning" comes in—a fancy term for letting the computer figure out which examples it needs to learn from next. However, even this gets stuck when the examples are too complex or too numerous. The big question scientists are asking is: Can we build a system that automatically invents these tricky examples on its own, so the robot gets tougher without needing a human to draw every single picture?

This paper introduces a clever solution called "Automatic Hard Example Synthesis with Multi-Level Agentic Data Curation." Think of it as a digital "Red Team"—a group of AI agents whose sole job is to try to break the safety robot. Instead of one robot trying to guess, the authors set up a team of three specialized AI "characters" working together. First, there's the Architect, a high-level thinker that comes up with wild ideas for how to trick the safety robot (like, "What if we make a picture of a puppy mill that looks like a cute pet store ad?"). Next, the Operator takes those ideas and actually generates the images. Finally, a Committee of other AI judges reviews the new images to see if they successfully tricked the safety robot or if they were too obvious.

The system works like a video game loop. The Architect tries a new idea. If the Committee agrees it's a tricky, borderline case, the system saves it as a "hard example." If the idea fails, the system doesn't just throw it away; it uses a strategy called "Explore and Mutate." This means it either tries a completely new idea (Exploration) or takes a previous idea that was almost successful and tweaks it slightly (Mutation) to make it even sneakier. The authors found that the best strategy was to mostly try new ideas (75%) but occasionally tweak old ones (25%) to avoid getting stuck in a loop of repeating the same mistakes.

The results are quite impressive. When the safety robot was tested on a benchmark called HoliSafe, it initially missed a huge chunk of the dangerous images, failing to flag them 41.2% of the time (a high False Negative Rate). But after the team used their AI agents to generate these tricky examples and showed them to the robot as "study guides" (a technique called In-Context Learning), the robot got much better. The failure rate dropped significantly to 24.5%. This happened without any humans drawing pictures or labeling data. The paper suggests that using a more advanced "brain" for the AI agents (like the Gemini 3 model) made the generated examples much better at finding the robot's weak spots compared to older models.

In short, the paper shows that we can build a self-improving safety system. By letting a team of AI agents playfully and aggressively try to break the rules, we can automatically find the most confusing edge cases. This helps the safety robot learn to spot the sneaky stuff much faster and more accurately than if we waited for humans to find every single trick. It's like having a tireless, creative coach who keeps inventing new drills to make the athlete stronger, ensuring the robot is ready for whatever weird, dangerous images might appear next.

Technical Summary: Automatic Hard Example Synthesis with Multi-Level Agentic Data Curation

Problem Statement

Multimodal Large Language Models (MLLMs) are increasingly deployed for nuanced content safety and moderation tasks, such as enforcing advertising policies on sensitive topics (e.g., algorithmic companionship, explicit content, illegal activities). However, these models remain vulnerable to adversarial attacks and out-of-distribution edge cases. The primary challenge lies in the "unknown unknowns"—vast regions of the policy boundary where harm is difficult to define visually, and where malicious actors continuously evolve tactics using subtle visual details, obfuscated text, or complex cross-modal interactions.

Traditional approaches to addressing this, such as manual annotation and standard active learning, fail to scale against the volume and complexity of novel multimodal threats. Existing labeled corpora often suffer from coverage gaps, leaving platforms exposed to emerging threats. Furthermore, manually curating diverse, difficult boundary examples across a large text-image space is profoundly unscalable, creating bottlenecks that require human expert review.

Methodology

The authors propose an automated, agentic data curation framework designed to systematically mine "hard examples" (boundary-pushing violations and ambiguous edge cases) without human intervention. The system operates on an iterative "Explore and Mutate" paradigm driven by a multi-agent architecture running on the Gemini 3 model backbone.

Core Architecture

The framework consists of three primary components:

Architect Agent ( $M_A$ ): Powered by Gemini 3.1 Pro, this agent synthesizes vulnerability hypotheses based on policy text and a small batch of seed examples. It leverages a persistent memory store of past attempts to either generate entirely novel hypotheses or mutate previously successful ones. The output is a structured tri-part proposition: a formal vulnerability hypothesis ( $h$ ), a detailed image generation prompt ( $p_{img}$ ), and a text overlay idea ( $t_{overlay}$ ).
Operator Agent ( $M_O$ ): Instantiated by Nano Banana Pro, this agent materializes the Architect's prompts into synthetic composite images ( $x$ ).
Multi-Level Verification Committee: A hierarchical system of LLM raters designed to resolve ambiguity and establish ground truth:
- Level I Committee ( $CR_1$ ): Composed of three independent instances of an efficient model (e.g., Gemini 3 Flash). They provide initial labels and measure ambiguity.
- Debate and Jury Protocols: If $CR_1$ fails to reach unanimous consensus, the system aggregates reasoning traces into a debate context ( $D$ ). Raters re-evaluate their positions. If disagreement persists, the instance is escalated to a Level II Jury Committee ( $CR_2$ ), composed of three instances of the more capable Gemini 3.1 Pro, to declare the final ground truth.

Data Curation Loop

The system iteratively loops through exploration and mutation. It archives synthetic assets where the Target Model ( $M_T$ ) disagrees with the unanimous consensus of the Level I committee (Target Errors) or where high ambiguity exists (Level I disagreements). These curated datasets serve as high-quality signals for downstream few-shot In-Context Learning (ICL).

Evaluation Strategy

The framework employs Retrieval-Augmented Generation (RAG) at test time. For an unseen query image, the system retrieves the $k$ most semantically similar mined examples (using cosine similarity) from the curated "Hard Pool" and integrates them as few-shot demonstrations. The study evaluates the impact of:

Retrieval Source: Hard Pool (adversarial boundary cases) vs. Regular Pool (standard consensus cases) vs. In-Distribution Pool (human-labeled).
Prompting: Naive prompting vs. Policy Prompting (prepending full textual policy guidelines).
Generation Backbone: Comparing pipelines using Gemini 3 Series agents vs. Gemini 2.5 Series agents.

Key Contributions

Novel Multi-Agent Architecture: The paper introduces a fully automated, hypothesis-driven "Explore and Mutate" paradigm comprising an Architect, Operator, and a committee of LLM raters. This system effectively synthesizes "hard examples" efficiently.
Hierarchical Verification System: A dual-level committee of LLM raters is introduced to systematically resolve and categorize high-ambiguity edge cases. The authors demonstrate that balancing generation strategies (75% novel exploration vs. 25% mutation) optimally prevents stalling and maximizes the discovery of hard examples.
Rigorous Evaluation of ICL Strategies: The paper highlights the critical importance of policy-informed prompting and dynamic retrieval. It demonstrates that retrieving from the agent-curated hard example pool significantly improves model robustness, reducing the False Negative Rate (FNR) from 41.2% to 24.5% on the HoliSafe benchmark compared to zero-shot baselines, without relying on human labeling.

Results

The framework was evaluated on the public HoliSafe-Bench and an internal Proprietary Ads Safety dataset (anonymized).

Impact of Policy Prompting: Incorporating explicit policy text into the prompt was a fundamental prerequisite for robust detection. On HoliSafe, this reduced the FNR from 0.869 (naive zero-shot) to 0.412.
Effectiveness of Hard Examples: Dynamic retrieval of synthesized hard examples further reduced the FNR to 0.245 (a significant improvement over the 0.412 zero-shot baseline with policy). Retrieval from the Hard pool consistently outperformed Regular or combined pools.
Role of Agent Capability: The quality of the curation pipeline heavily influenced results. The Gemini 3 Series pipeline (using Gemini 3.1 Pro Architect) achieved an FNR of 0.245, whereas the Gemini 2.5 Series pipeline only achieved 0.405, barely improving over the zero-shot baseline. This suggests that advanced reasoning capabilities are necessary to synthesize nuanced failure modes.
Optimal Configuration: An ablation study on the ratio of novel vs. mutated hypotheses found that a 75% novel / 25% mutated split yielded the highest discovery rate of hard examples (16.7% hit rate), preventing the agent from getting stuck in local optima.
Context Size: A fixed few-shot size of k=4 was found to be optimal, balancing performance with latency.

Significance and Claims

The paper claims that this framework offers a scalable solution for evaluating and improving MLLM alignment in high-stakes, ambiguous, or rapidly evolving risk environments. By autonomously surfacing complex edge cases, the system enables safeguard systems to adapt proactively to emerging visual threats without the bottleneck of costly human annotation.

The authors emphasize that their approach not only accelerates the detection of vulnerabilities but also reveals fundamental ambiguities within the policies themselves. They position this as a shift from tactical prompt adjustments to structural architectural redesigns for content safety.

Limitations Acknowledged:

Reliance on Frontier Models: The success of the pipeline is heavily dependent on the reasoning capabilities of the underlying foundation models (e.g., Gemini 3 Series).
Synthetic-to-Real Gap: While the Operator agent generates diverse scenarios, accurately replicating specific real-world adversarial attacks (e.g., multi-image composite layouts, targeted typographic attacks) remains challenging for standard diffusion generators.
Inference Overhead: Dynamic RAG introduces latency compared to zero-shot prediction, though the authors suggest future work could distill these examples into compact student models.
Precision-Recall Trade-off: The aggressive mining of hard examples can shift the decision boundary toward a more conservative posture, potentially slightly degrading precision (increasing False Positives) while significantly improving recall (reducing False Negatives).