Pair-Aware Optimization 提出 ZO-FO 混合框架，破解 LLM Agent
Pair-Aware Optimization: Coordinating Exploration and Refinement for Jailbreaking LLM Agents
一篇研究怎么攻击 LLM Agent 的论文，把梯度方法和无梯度方法按顺序组合起来，比单用一种效果好，做安全评测的可以看看。
arXiv 论文提出 Pair-aware optimization 方法，系统比较了纯 ZO、纯 FO、ZO->FO 和 FO->ZO 四种攻击策略。该框架先用零阶（ZO）优化探索对抗性前缀，再用一阶（FO）优化精炼对应后缀，并保留多个前缀候选，条件性筛选前缀-后缀配对。论文还从随机生成视角分析 Agent 越狱，在优化和评估阶段采用一致的随机解码。在恶意指令和恶意环境基准上的实验显示，混合优化比单一优化器方法攻击成功率更高，且优化顺序对性能影响显著。
Pair-Aware Optimization: Coordinating Exploration and Refinement for Jailbreaking LLM Agents
Large Language Model (LLM) agents are vulnerable to adversarial inputs that induce attacker-specified malicious behaviors, commonly referred to as jailbreaking. Existing optimization-based jailbreak attacks primarily employ first-order (FO) methods that leverage gradient information or zeroth-order (ZO) methods that rely on function-value feedback. However, their complementarity and optimization ordering remain underexplored. We systematically investigate four strategies: pure ZO, pure FO, ZO->FO, and FO->ZO, and develop a ZO-FO framework that explores adversarial prefixes through ZO optimization and refines their corresponding suffixes through FO optimization. To coordinate the two processes, we introduce Pair-aware optimization, which retains multiple prefix candidates, conditionally refines their suffixes and selects among the resulting prefix-suffix pairs. We further investigate agent jailbreaking from a more general stochastic-generation perspective, where the same adversarial input can induce diverse reasoning trajectories and actions that a single greedy output cannot capture. Accordingly, we adopt consistent stochastic decoding during both optimization and evaluation. Experiments across malicious-instruction and malicious-environment benchmarks demonstrate that hybrid optimization improves attack effectiveness over single-optimizer methods, while optimization order substantially influences performance.
