Source-linked AI summary
OpenRT: An Open-Source Red Teaming Framework for Multimodal LLMs
Xin Wang, Yunhao Chen, Juncheng Li, Yixu Wang, Yang Yao, Tianle Gu, Jie Li, Yan Teng, Yingchun Wang, Xia Hu
TL;DR
MLLM safety evaluation remains fragmented and existing defenses remain vulnerable to adversarial attacks. OpenRT provides a modular, high-throughput framework integrating diverse attack methods and evaluation components, and its study of 20 advanced models reports substantial residual vulnerability, including a 49.14% average ASR. The framework is released as continuously maintained infrastructure for ongoing safety evaluation and defense improvement.
Problem
Existing MLLM defenses remain vulnerable to adversarial attacks, while red-teaming evaluation is fragmented across attacks, threat models, and target models.
Method
OpenRT unifies models, datasets, attacks, judges, and evaluators in a modular high-throughput framework integrating 37 attack methods.
Results
Across 20 advanced MLLMs, the study reports a 49.14% average ASR, with individual ASRs ranging from 13.4% to 72.5%.
Takeaways & Limitations
OpenRT provides an open-source, continuously maintained infrastructure for standardized attack evaluation and defense improvement.
Takeaways & Limitations
The black-box threat model restricts the adversary to API or inference-interface access without internal gradients or logits.
Abstract
from arXiv · showhide
The rapid integration of Multimodal Large Language Models (MLLMs) into critical applications is increasingly hindered by persistent safety vulnerabilities. However, existing red-teaming benchmarks are often fragmented, limited to single-turn text interactions, and lack the scalability required for systematic evaluation. To address this, we introduce OpenRT, a unified, modular, and high-throughput red-teaming framework designed for comprehensive MLLM safety evaluation. At its core, OpenRT architects a paradigm shift in automated red-teaming by introducing an adversarial kernel that enables modular separation across five critical dimensions: model integration, dataset management, attack strategies, judging methods, and evaluation metrics. By standardizing attack interfaces, it decouples adversarial logic from a high-throughput asynchronous runtime, enabling systematic scaling across diverse models. Our framework integrates 37 diverse attack methodologies, spanning white-box gradients, multi-modal perturbations, and sophisticated multi-agent evolutionary strategies. Through an extensive empirical study on 20 advanced models (including GPT-5.2, Claude 4.5, and Gemini 3 Pro), we expose critical safety gaps: even frontier models fail to generalize across attack paradigms, with leading models exhibiting average Attack Success Rates as high as 49.14%. Notably, our findings reveal that reasoning models do not inherently possess superior robustness against complex, multi-turn jailbreaks. By open-sourcing OpenRT, we provide a sustainable, extensible, and continuously maintained infrastructure that accelerates the development and standardization of AI safety.
Takeaway Messages
OpenRT finds that advanced MLLMs often resist simple, recognizable attacks but remain vulnerable to adaptive, cross-modal, and multi-agent strategies. Robustness is polarized across attack families, and the authors argue for defense-in-depth with continuous red teaming.
- Attack landscape: Adaptive, multi-turn, and multi-agent attacks can exceed 90% ASR even against advanced models.Static, single-turn, and template-based attacks are increasingly ineffective by comparison.
- Polarized robustness: Grok 4.1 Fast shows 1.5% ASR against RedQueen but 90.5% against X-Teaming.The approximately 90% disparity illustrates polarized vulnerability across attack families.
- Capability-related risks: Reasoning-enhanced models do not demonstrate superior robustness, and verbose reasoning can be manipulated to bypass safety filters.Visual inputs can also bypass text-based safety mechanisms in multimodal models.
- Model comparison: Only GPT-5.2 and Claude Haiku 4.5 maintained average ASR below 30% across the 20 evaluated models.All other models consistently exceeded this threshold in the reported analysis.
- Mitigation: Defense-in-depth combines architectural safety, runtime risk estimation, and adversarial training on multimodal and multi-turn interactions.The authors identify continuous red teaming as necessary for verifying empirical robustness and preventing benchmark overfitting.
1 Introduction
OpenRT addresses fragmented and narrow red-teaming evaluation with a modular, high-throughput framework spanning diverse models, attacks, and evaluation components. Its benchmark of 20 advanced MLLMs reveals substantial residual vulnerability, while its open-source maintenance model supports continued evaluation and defense improvement.
- Motivation: Existing red-teaming evaluation remains fragmented across narrow attack subsets, threat models, and target-model selections.This fragmentation undermines reproducible benchmarking and systematic vulnerability evaluation.
- Framework: OpenRT decouples models, datasets, attacks, judges, and evaluators under a central orchestrator for high-throughput evaluation.The framework supports massively parallel jailbreaking in both white-box and black-box settings.
- Evaluation: 20 advanced MLLMs were evaluated, exposing widespread safety vulnerabilities across current deployments.The study includes models such as GPT-5.2, Claude Haiku 4.5, Gemini 3 Pro Preview, Qwen3-Max, Doubao-Seed-1.6, and DeepSeek-V3.2.
- Evaluation: 49.14% average ASR was reported across the evaluated models, with individual ASRs ranging from 13.4% to 72.5%.The results indicate that even advanced models remain susceptible to adversarial attacks.
- Framework: 37 attack implementations span white-box and black-box threat models, including multi-turn, multimodal, and multi-agent strategies.The attack suite ranges from direct prompting to population-based optimization and diversity-driven approaches.
- Contribution: OpenRT is released with a long-term maintenance commitment to support attack evaluation and defense improvement.The project is intended to integrate new methods over time.
2 Related Work
Prior red-teaming work spans manual efforts, automated attack discovery, and standardized benchmarks, but existing tools remain limited in coverage or scope. OpenRT distinguishes itself by unifying diverse attacks and models in a scalable, modular evaluation framework.
- Red teaming: Manual red teaming can uncover subtle vulnerabilities but is limited by scalability, cost, and coverage.Automated red teaming emerged partly to address these constraints.
- Red teaming: Automated approaches include genetic algorithms, token-level combinatorial methods, gradient optimization, and iterative LLM-driven prompt refinement.These methods primarily frame jailbreak discovery as input-space search.
- Benchmarks: JailbreakBench and HarmBench provide large-scale test suites and principled metrics for benchmarking adversarial defenses.EasyJailbreak offers a modular pipeline implementing numerous attack families.
- OpenRT distinction: OpenRT combines large-scale jailbreaking, a unified asynchronous execution engine, and modular integration of 37 attack strategies.Its comparison framework also distinguishes interaction patterns, configurability, and extensibility.
- OpenRT distinction: OpenRT is distinguished by comprehensiveness, scale, and native support for diverse MLLMs.It unifies attack methods in a modular framework rather than focusing on a narrow attack subset.
3 Framework
OpenRT provides a unified platform for systematic MLLM safety evaluation, addressing fragmented red-teaming through modular components and reproducible comparisons across attack settings. Its framework formalizes multimodal adversarial examples and supports both black-box and white-box threat models.
- OpenRT unifies MLLM safety evaluation by separating models, datasets, attacks, judges, evaluators, and orchestration for fair, reproducible comparisons.The framework is designed to support diverse attack methodologies and both black-box and white-box paradigms.
- Threat Model: Black-box adversaries observe only model outputs through an API while operating under query and request-rate constraints.
- Threat Model: White-box adversaries access parameters, gradients, and hidden embeddings, enabling gradient-based worst-case robustness analysis.
- Problem Formulation: The evaluation objective is to maximize Attack Success Rate over harmful queries, with success determined by a safety judge.
- Problem Formulation: OpenRT represents multimodal inputs as visual and textual components, then creates adversarial examples through discrete prompt perturbations or continuous visual noise.The resulting response is intended to violate the model’s predefined safety alignments.
- Problem Formulation: The attack objective optimizes adversarial examples toward harmful target tokens while constraining visual perturbation magnitude and textual perplexity.For text-only attacks, the visual terms are omitted and optimization operates solely on the discrete prompt.
3.2 Component Overview
OpenRT implements red-teaming as a decoupled pipeline of interchangeable components, covering model access, datasets, attacks, judging, evaluation, orchestration, and extensible registration. Its execution supports multimodal and multi-turn attacks, parallel benchmarking, configurable metrics, and fault-isolated reporting.
- Component Architecture: OpenRT decomposes red teaming into six independently replaceable components: Model, Dataset, Attack, Judge, Evaluator, and Orchestrator.This decoupling allows components to be changed without modifying the others.
- Model: The Model component abstracts cloud APIs and local deployments, supporting multimodal inputs, conversation history, retries, gradients, and embeddings.Local models enable white-box attacks, while API-based models support OpenAI-style interfaces.
- Dataset: Datasets organize harmful queries for evaluation, with StaticDataset supporting small in-memory tests and JSONLDataset streaming large benchmarks.
- Attack: OpenRT implements 37 jailbreak methods spanning gradient optimization, genetic algorithms, LLM refinement, encoding, deception, multimodal exploitation, and multi-agent coordination.Each attack transforms a harmful query into an adversarial example and returns structured results.
- Judge: The Judge combines keyword matching for rapid refusal detection with an independent LLM for semantic analysis of complex responses.It assigns harmfulness scores from 1 for proactive refusal to 5 for full compliance with harmful instructions.
- Judge: An attack succeeds when its harmfulness score s meets or exceeds the configurable threshold θ within [1, 5].
- Evaluator: The Evaluator aggregates attack outcomes into metrics for effectiveness, efficiency, stealthiness, and diversity.Attack efficiency measures consumed resources, stealthiness measures imperceptibility, and diversity measures the breadth of adversarial strategies.
- Orchestrator: The Orchestrator initializes resources, executes attacks in parallel, aggregates results, and reports final metrics while isolating individual failures.Thread pools, progress tracking, fault isolation, and YAML configuration support scalable and reproducible experiments.
4 Experiments
OpenRT evaluates 37 black-box attack methods across more than 20 language and multimodal models using complementary measures of effectiveness, efficiency, stealthiness, and diversity. Results show highly uneven, attack-dependent vulnerabilities, with adaptive and multi-agent methods often outperforming static approaches while incurring different resource and diversity trade-offs.
- Experimental setup: 37 distinct attack methods were evaluated across single-turn, multi-turn, multimodal, and multi-agent strategies in a unified black-box framework.Methods were configured with parameters such as iterations, mutation rates, query budgets, and other attack-dynamics settings.
- Attack effectiveness: Adaptive attacks such as EvoSynth, X-Teaming, GPTFuzzer, and PAIR achieved strong or near-universal success across many models, whereas RedQueen and CoA were less consistent.EvoSynth approached 100% ASR across several MLLMs; GPTFuzzer reached 87%–97% and PAIR 80%–95% on reported LLM examples.
- Attack effectiveness: Adversarial robustness was highly attack-dependent and model-dependent, with models often resisting weak prompts but failing against adaptive attacks.MiniMax-M2 had 0% ASR against DeepInception but 90% against PAIR, illustrating polarized outcomes across attack families.
- Efficiency: GPTFuzzer was the most resource-intensive method at 9.44M total tokens and 9,705 calls, while lightweight methods such as FlipAttack, Prefill, JailBroken, and ICA used fewer than 200k tokens.DrAttack, Crescendo, and AutoDAN followed GPTFuzzer in total token consumption, reflecting the cost of iterative querying.
- Diversity: High-diversity methods included EvoSynth at 0.820 and X-Teaming at 0.795, while RainbowTeaming, CS-DJ, and JOOD produced diversity below 0.001.Multi-agent and iterative methods generally explored broader adversarial strategies, whereas deterministic transformation methods generated structurally similar prompts.
- Diversity: Diversity did not always correlate with ASR: Mousetrap reached 97.5% ASR with diversity 0.174, while TreeAttack achieved 11.0% ASR with diversity 0.766.The results support combining high-diversity methods for vulnerability discovery with targeted low-diversity attacks for known weaknesses.
5 Conclusion
OpenRT provides a unified infrastructure for evaluating MLLM safety across diverse attacks and models. Its large-scale evaluation exposes persistent vulnerabilities in current safety mechanisms and supports continued expansion of red-teaming capabilities.
- Framework and evaluation: OpenRT integrates 37 attack methods into a standardized platform for benchmarking 20 advanced models and diverse attack strategies.The framework is presented as unified, extensible infrastructure for comprehensive red-teaming evaluation.
- Findings and outlook: The evaluation revealed significant safety vulnerabilities in state-of-the-art systems, showing that current mechanisms are often ineffective against varied adversarial techniques.The paper positions OpenRT as infrastructure for studying persistent defense gaps and future adversarial-robustness research.
A Appendix: Usage and Extensibility
This appendix section describes how to use OpenRT for security evaluations and extend it with custom attack methods.
- Usage and extensibility: OpenRT supports running security evaluations and extending the framework with user-defined attack methods.The section is focused on framework usage and extensibility.
A.1 Basic Usage
OpenRT can be installed, configured, and run through command-line or programmatic workflows, with metrics and detailed results saved for inspection. Its programmatic interface composes models, datasets, attacks, judges, evaluators, and an orchestrator.
- Installation: OpenRT can be installed from source using the requirements file and setup script.The documented commands are `pip install -r requirements.txt` and `python setup.py install`.
- Running experiments: Experiments can be launched from YAML configuration files using the main program and an experiment-specific configuration path.The example invokes `python main.py --config configs/autodan_turbo_experiment.yaml`.
- Running experiments: Programmatic experiments compose an OpenAI model, helper model, static dataset, judge, attack, evaluator, and orchestrator.The example configures PAIR with a maximum of five iterations and evaluates it with an LLM judge.
- Execution and metrics: The orchestrator runs the configured experiment and returns metrics and results, including the Attack Success Rate.The example prints ASR as a percentage after execution.
- Output inspection: Results are saved in a model- and timestamp-specific folder containing metric JSON files and detailed JSONL attack results.The example output includes separate files for PAIR metrics and results.
A.2 Extending Attacks
OpenRT extends its attack library through a registered BaseAttack implementation, whose attack method iterates prompts, queries the model, and returns an AttackResult. Custom attacks are then available for experiments.
- New attacks are added by implementing the BaseAttack interface and registering the class with OpenRT's attack registry.The example uses a registered MyAttack subclass.
- The example loops for a configured maximum number of iterations, crafts an adversarial prompt, queries the model, and checks the response for success.Successful and unsuccessful outcomes produce different AttackResult records.
- The attack method accepts a target string and returns an AttackResult.The result records whether the attack succeeded and can include the final prompt, output text, and method name.
- Once registered, a custom attack becomes available for use in experiments through configuration.
A.3 Configuration
Complete OpenRT experiments can be declared in YAML, allowing the Orchestrator to instantiate and connect the model, dataset, attack, judge, and evaluator. The example specifies experiment, model, data, and attack settings.
- YAML configuration lets the Orchestrator dynamically instantiate and wire together the model, dataset, attack, judge, and evaluator.This allows complete experiments to be declared without manually assembling each component.
- The example names the experiment Comprehensive_Safety_Evaluation.
- The model configuration specifies gpt-5.1, temperature 0.7, and an API key supplied through OPENAI_API_KEY.
- The dataset is loaded from data/advbench.jsonl.
- The attack configuration selects autodan_turbo.