PaperlayerView exact revision on arXiv

Source-linked AI summary

FinRT: Distilling Adaptive Red-Teaming Strategies into Reusable Adversarial Generators in Consumer Finance

Rikhiya Ghosh, Himanshu Kumar, Sriram Venkatapathy, Sahil Wadhwa, Alexandre G. R. Day, Pranab Mohanty

arXiv:2609.36474v1cs.CLcs.CRcs.LG

TL;DR

Realistic customer queries can trigger policy failures in regulated-domain LLM applications, while existing red-teaming approaches often treat coverage, severity, realism, and diversity as incidental objectives. FinRT discovers failures adaptively and distills them into reusable adversarial prompt generators. Across six open-source victim LLMs, it improves attack outcomes while amortizing attack generation.

  • Problem

    Existing red-teaming methods struggle to capture realistic, domain-specific policy violations, and often treat coverage, severity, realism, and diversity as incidental rather than joint objectives.

    Source: §1 · p. 1

  • Method

    FinRT adaptively discovers failures across structured policy, domain, and strategy spaces, then distills them into a reusable conditional prompt generator.

    Source: §1 · p. 2, §3 · p. 3

  • Results

    33% vs 15.5%: FinRT nearly doubles attack success rate over adaptive baseline PAIR across six open-source victim LLMs, while increasing maximum attack severity by 33%.

    Source: §1 · p. 2

  • Takeaways & Limitations

    FinRT amortizes adaptive search into reusable generation, with reported attack generation requiring no iterative victim-model feedback beyond final evaluation probes.

    Source: §1 · p. 2, §7 · p. 9

    The study focuses on consumer finance with seven policy families and fixed domain and behavior specifications; its legal evaluation uses only six policy cards and is a stress test, not evidence of broad generalization.

    Source: Limitations · p. 10

Abstract

from arXiv · show

In regulated industries like consumer finance, seemingly harmless user queries can exploit large language model vulnerabilities, triggering safety failures and pushing responses dangerously close to policy limits. Existing automated red-teaming methods trade off attack effectiveness against generation cost, while treating coverage, severity, and diversity as incidental rather than joint objectives. We introduce FinRT, a structured framework that builds reusable adversarial prompt generators from adaptive red-teaming strategies. Across the six victim models in consumer finance, FinRT substantially outperforms adaptive search baselines while amortizing target-facing attack generation into a reusable generator. FinRT nearly doubles the attack success rate over the adaptive baseline Rainbow Teaming (32.9% vs. 17.2%), increases maximum adversarial severity by 33%, and preserves comparable intra-policy-domain semantic diversity to iterative search methods. Our method achieves high cross-model transferability while exhibiting distinct victim-family specialization patterns.

1 Introduction

FinRT addresses realistic, policy-sensitive failures that existing red-teaming methods struggle to uncover and amortize. It combines adaptive discovery with reusable prompt generation, and its evaluation reports higher attack success and severity than an adaptive baseline.

Motivation

  • Existing red-teaming methods struggle with realistic, domain-specific policy violations, while adaptive approaches are costly and target-specific and amortized methods cover only narrow attack dimensions.In consumer finance, failures can arise from benign-looking queries and the combined policy, user context, and domain.Source: §1 · pp. 1–2

Approach

  • Forward elicitation searches policy, prompting-strategy, and domain-intent combinations for failures; inverse elicitation uses those failures to train a reusable generator.The generator produces policy-violating queries conditioned on policy, domain intent, and target behavior in one forward pass.Source: §1 · p. 2

Evaluation

  • 33% vs 15.5%: FinRT nearly doubles attack success rate over adaptive baseline PAIR across six open-source victim LLMs.It also increases maximum attack severity by 33% and preserves intra-cell semantic diversity comparable to iterative search, without iterative victim-model feedback during attack generation beyond final evaluation probes.Source: §1 · p. 2

Approach

  • FinRT frames regulated-domain red teaming as structured failure discovery across policy, strategy, domain, and target-behavior dimensions.It makes coverage, severity, domain realism, and diversity joint objectives.Source: §1 · p. 2

Contributions

  • FinRT proposes calibrated proxy preference optimization as a lower-cost approximation of target model-specific DPO.It also proposes realism-constrained coverage to measure realistic policy-failure coverage and explores the attack landscape across six victim-model families.Source: §1 · p. 2

2 Related Work

Prior work spans iterative attack search, amortized prompt generation, synthetic instruction data, and policy-aware financial red teaming. FinRT distinguishes itself by conditioning generation on structured policy, domain, and behavior specifications.

Automated Red Teaming

  • Iterative attack methods use model feedback but typically require repeated target interaction, whereas amortized generators produce attacks in one pass but condition on narrower taxonomies.FinRT instead distills successful attack trajectories into a reusable conditional generator.Source: §2 · p. 3

Synthetic dataset generation

  • Synthetic instruction methods bootstrap training corpora, while FinRT uses synthetic supervision to generate adversarial prompts conditioned on policy, domain, and target behavior.The cited prior methods include Self-Instruct and Evol-Instruct (Wang et al., 2023; Xu et al., 2023).Source: §2 · p. 3

Domain-specific and policy-aware red teaming

  • The work represents each evaluation instance as a policy–domain–behavior specification, enabling targeted generation of realistic prompts that operationalize specific policy violations within a concrete domain context across banking, financial services and insurance.FinSafetyBench (Hou et al., 2026) and CNFINBench cover financial crime and ethics categories; BFSI risk-adjusted scoring (Dimino et al., 2026) proposes severity-weighted evaluation.Source: §2 · p. 3

3 Methodology

FinRT treats regulated-domain red-teaming as structured failure discovery followed by reconstruction into a reusable adversarial prompt generator. Forward elicitation explores policy, domain, and strategy combinations; inverse elicitation trains generators conditioned on policy, domain, and extracted target behavior.

3 Methodology

  • FinRT separates exploration over policy–domain–strategy space from generation over policy–domain–behavior space, decoupling adversarial search from structured prompt generation.The strategy space includes procedural mechanisms such as deception, obfuscation, indirect elicitation, and procedural manipulation.Source: §3 · p. 3

3.1 Forward Elicitation

  • Forward elicitation seeds policy–strategy–domain combinations, evaluates prompts for attackability, realism, and structural fidelity, and adaptively explores high-value regions.Successful prompt–response trajectories are summarized as target behaviors for inverse elicitation.Source: §3.1 · pp. 4–5
  • Coverage-constrained selection filters out prompts below realism and structural-fidelity thresholds, then selects attackable prompts while preserving broad policy–domain–strategy coverage.The selection objective is optimized using lazy greedy selection based on marginal gain.Source: §3.1 · p. 4

3.2 Inverse Elicitation

  • Inverse elicitation trains a conditional generator on successful prompts paired with policy–domain–behavior specifications, then uses preference optimization to target attack quality and realism.Preference pairs rank prompts by a score combining attackability and realism.Source: §3.2 · p. 5

Calibrated Proxy Preference Optimization

  • Calibrated proxy preference optimization weights proxy-model preference signals by local agreement with a target victim, producing target-conditioned generators with distinct transfer and specialization behaviors.Agreement is estimated within policy–domain–behavior regions, and the resulting supervision avoids repeatedly optimizing against the target model itself.Source: Calibrated Proxy Preference Optimization · p. 5

4 Experimental Setup

The experiments evaluate FinRT and red-teaming baselines on consumer-finance data, across six victim models and held-out structured specifications. The setup also compares generator ablations and uses a two-pass judging process.

Domain datasets and Preprocessing

  • The evaluation uses Banking77 and CFPB consumer-finance data, with intent examples clustered into 211 canonical domain intents.Banking77 contains 13,083 English-language queries across 77 banking intents, while CFPB provides consumer grievances about financial products and services.Source: §4 · p. 5

Victim LLMs

  • Six victim models spanning multiple alignment families and scales are evaluated as black boxes at inference time.The models are Llama-3.3-70B, Llama-3.1-8B, Mixtral-8x7B, Gemma-4-31B, GPT-OSS-20B, and Nemotron-3-Super-120B.Source: §4 · p. 6

Structured specification space

  • The structured space contains 7 policies, 211 domain intents, and 30 elicitation strategies, with 149 normalized target adversarial behaviors used for inverse-elicitation training and evaluation.The intents comprise 77 Banking77 and 134 CFPB intents.Source: §4 · p. 6

Baselines and Ablations

  • Baselines receive the same budget of 10 final prompts per policy–domain–behavior specification per victim, and ablations compare SFT, universal-proxy DPO, oracle DPO, and calibrated-proxy DPO.Table 1 compares FinRT with synthetic and adaptive red-teaming baselines across six victim models on 419 held-out specifications.Source: §4 · p. 6, Table 1 · p. 6

Judge Models

  • A two-pass judge architecture evaluates attack success, severity, confidence, and rationale, with cross-critiques, recalibration, and manual review of discordant judgments.The first-pass judges are GPT-OSS-120B and Claude Opus 4.6.Source: §4 · p. 6

5 Evaluation Metrics

Evaluation measures attack success under a fixed prompt budget alongside severity, realistic coverage, and semantic diversity. Metrics are computed over held-out policy–domain–behavior specifications or cells, depending on the measure.

Overall ASR@10

  • ASR@10 reports the fraction of prompts inducing policy-violating responses under a fixed budget of ten prompts per specification.The evaluation uses 419 specifications, aggregates ten prompt outcomes within each specification, and bootstraps specifications for 95% confidence intervals.Source: §5 · pp. 6–7

Max Severity

  • Maximum severity averages the highest judge-assigned severity among successful prompts in each policy–domain cell, assigning zero to uncovered cells.This measure combines attack success and impact.Source: §5 · p. 7

Realism-Conditioned Coverage@k

  • RC-Cov@10 counts held-out policy–domain cells with at least one successful prompt, restricting coverage to prompts with realism above 0.65.The measure captures coverage by attacks that are both successful and operationally plausible.Source: §5 · p. 7

Diversity

  • Vendi score estimates the effective number of semantically distinct prompts generated within each policy–domain cell, averaged across cells.Figure 2 presents severity breakdowns for top-performing baselines and FinRT methods, highlighting the proportion of severity 3–4 attacks.Source: §5 · p. 7, Figure 2 · p. 7

6 Evaluation

Evaluation tests whether reusable generators match synthetic attack methods, whether calibrated proxy DPO approaches target-oracle optimization, and what structure attacks reveal across policies, domains, and victims.

6.1 Baseline comparison

  • FinRT-SFT increases attack reliability and high-severity attack frequency while preserving nearly the same intra-P×D semantic diversity as iterative search and performing strongly across all target models.Generic synthetic instruction methods remain weak and poorly transferable, while adaptive search concentrates attacks in low-to-moderate severity regions.Source: §6.1 · p. 8
  • Preference optimization concentrates capability toward Llama and Mixtral victim families, producing sharper but less uniformly transferable profiles; the authors attribute this to calibrated proxies' family representation.DPO methods also show more high-severity attacks and more domain-realistic prompts.Source: §6.1 · p. 8
  • FinRT-SFT produces violations in more evaluation specifications than PAIR-Lite (McNemar χ2 = 10.87, p < 0.001) and higher mean violation severity (Wilcoxon z = 5.34, p < 10−7).Table 2 reports paired evaluation-specification comparisons.Source: Table 2 · p. 7, §6.1 · p. 8

6.2 Performance of proxy calibration against target-oracle preference optimization

  • Calibrated proxy DPO matches target-oracle DPO on average and exceeds it on the most attackable victims, while transfer clusters across aligned families and calibrated weighting improves overall ASR.Transfer is strong to Llama-3.1-8B, Llama-3.3-70B, and Mixtral-8x7B; other models remain more resistant.Source: §6.2 · p. 8

6.3 Attack analysis

  • Attackability varies across policy–domain–behavior combinations: fraud, unauthorized financial activity, and debt collection are more vulnerable, while privacy, fairness, and market-abuse regions are comparatively robust.Credential exploitation transfers broadly despite privacy-oriented policy regions being robust overall; high-severity behaviors concentrate around payment systems, digital banking, debt collection, and credit reporting.Source: §6.3 · pp. 8–9

6.4 Generalization of FinRT beyond primary evaluation

  • On the independently constructed FinSafetyBench, FinRT-DPO-calibrated achieves 35.2% overall ASR across six victim models.The benchmark's 1,851 prompts were mapped to policy–domain–target-behavior specifications and were not used during training.Source: §6.4 · p. 9
  • In a small legal-assistance stress test, FinRT-DPO-calibrated achieves 22.6% overall ASR versus 12.1% for PAIR-Lite, which the authors treat as preliminary cross-domain transfer evidence.The test uses six new policy cards spanning eleven legal domains.Source: §6.4 · p. 9

7 Conclusion

FinRT reframes regulated-domain red teaming as compositional failure discovery and reconstruction, training reusable generators from structured elicitation. Across consumer-finance victim families, it improves attack outcomes and shows that proxy calibration can recover much of target-specific preference training's performance.

7 Conclusion

  • FinRT combines forward elicitation over policy–domain–strategy spaces with inverse elicitation over policy–domain–behavior spaces to train reusable generators that amortize adaptive search into a single forward pass.The framework casts adversarial prompt generation as a compositional failure discovery and reconstruction problem.Source: §7 · p. 9
  • Across six consumer-finance victim model families, FinRT improves attack success, severity, and realism-conditioned coverage while preserving strong semantic diversity and transferability.The conclusion characterizes vulnerabilities as structured around specific policy–behavior–context interactions.Source: §7 · p. 9
  • Calibrated proxy optimization recovers most of target-specific preference training's performance without directly optimizing against the target model.The paper also finds that adversarial preference structure transfers non-uniformly across alignment families.Source: §7 · p. 9
  • The findings support treating realistic regulated-domain red teaming as a learnable, transferable modeling problem rather than solely as iterative adversarial search.Source: §7 · p. 9

Limitations

FinRT’s evidence is centered on consumer-finance safety, with limited external-transfer testing and substantial offline construction costs. Its reusable-generator benefit is amortization, not lower total compute.

Limitations

  • The legal evaluation uses only six policy cards and is a stress test, not evidence of broad generalization across regulated domains.The study primarily uses seven structured consumer-finance policy families and fixed domain and behavior specifications.Source: Limitations · p. 10
  • FinRT’s reusable-generator advantage is amortization, and depends on enough subsequent evaluations and model releases to offset substantial offline construction costs.Forward elicitation requires large-scale target-independent generation, filtering, scoring, and behavior extraction before training.Source: Limitations · p. 10
  • The uncensored-model surrogate may miss behaviors uniquely vulnerable on particular alignment families, while calibrated proxy DPO may weaken when proxy and target safety mechanisms differ.Evaluation also relies on LLM judges; residual errors cluster near subtle policy and severity boundaries despite human audit and adjudication.Source: Limitations · p. 10
  • Policy, strategy, and target-behavior spaces remain partly human-structured; the policy families are not exhaustive, and evaluation is static, black-box, and primarily single-turn.Adaptive defenses, continuously updated models, online monitoring, and sustained multi-turn attacks are not studied.Source: Limitations · p. 10

Ethical Considerations

The paper frames FinRT as defensive research and limits released artifacts to reduce dual-use risk. Experiments use public models in controlled settings, with human oversight and governance emphasized for production use.

Ethical Considerations

  • FinRT is intended for defensive security evaluation, safety auditing, and alignment research.Source: Ethical Considerations · p. 10
  • To reduce dual-use risk, the authors withhold high-severity prompts, target-specific DPO adapters, and complete attack-generation pipelines, releasing only filtered subsets for defensive benchmarking.Source: Ethical Considerations · p. 10
  • Experiments use publicly available models in controlled research settings, and the authors emphasize human oversight, responsible disclosure, and domain-specific governance before production deployment.Source: Ethical Considerations · p. 10

AI Usage

The paper reports AI assistance in both experimentation and manuscript preparation.

AI Usage

  • Claude Code with Opus 4.6 was used to generate code for experimentation and dataset processing.Source: AI Usage · p. 10
  • Gemini and Claude Opus 4.6 were used for grammar and fluency checks.Source: AI Usage · p. 10

A.1 Policies

This appendix documents FinRT’s policy-card framework and experimental setup, including taxonomy validation, generator construction and cost, baselines, models, and judge reliability. It also reports robustness checks and examines attackability across policy–domain contexts and behavior families.

A.2 Policy Taxonomy Construction and Validation

  • FinRT’s policy cards define seven consumer-finance safety families, distinguish prohibited behavior from benign or out-of-scope responses, and grade violations on a 0–4 severity scale.Experts in financial risk, compliance, and cybersecurity iteratively reviewed taxonomy coverage, boundary clarity, and severity consistency.Source: §A.2 · pp. 13–14
  • The taxonomy maps major safety dimensions in FinSafetyBench and CNFinBench to its seven policy families, often collapsing finer-grained categories into broader operational policies.This is a construct-validity check, not a claim that the cards exhaustively encode financial regulation.Source: §A.2 · p. 15, Table 4 · p. 16

A.3 Forward Elicitation

  • Forward elicitation generated 300k prompts, filtered and selected candidates into a 10k seed pool, then produced a 33k dataset tested for attackability and passed to inverse elicitation.The process clustered domain intents, used judges to assess fidelity, realism, and severity, and applied 500k AIC steps for obfuscation.Source: §A.3 · p. 15

A.4.1 Dataset details

  • The SFT training set contains 9,160 prompts with the highest attackability and realism scores across 2,847 policy-domain-target behavior specifications; each DPO dataset contains 15k preference pairs.The SFT prompts were further split 90:10 into train and evaluation sets. Separate DPO adapters were trained per target victim model from the SFT checkpoint.Source: §A.4.1 · p. 15, §A.4.2 · p. 15

A.5 Cost Accounting and Amortization Analysis

  • FinRT’s construction cost is largely target-independent and is amortized into a reusable generator that produces prompts in one forward pass without iterative target-model search.Forward elicitation accounts for approximately 1.52M target-independent LLM calls; proxy calibration uses 6,936 victim-model calls across six targets, while oracle DPO preference construction uses approximately 40K target-model calls.Source: §A.5 · p. 16, Table 7 · p. 18

A.6.1 Self-Instruct

  • Self-Instruct bootstraps prompts through three self-improvement iterations, while Evol-Instruct mutates and expands seed prompts using semantic transformations, added constraints, and obfuscation.Both methods generate 10 prompts per held-out policy-domain-behavior specification, yielding 4,190 final prompts.Source: §A.6.1 · pp. 16–17, §A.6.2 · p. 17

A.6.3 PAIR-Lite

  • PAIR-Lite runs three refinement streams for up to five turns per specification, while AIC composes each of 4,190 queries with its highest-scoring tactic from a pool of 13,311 tactics.Rainbow Teaming searches for 400 iterations per specification; the approximate AutoRed reproduction achieved an ASR of 11.3% and is treated as indicative, not exact.Source: §A.6.3 · p. 17, §A.6.4 · pp. 17–18

A.7.1 Target Models

  • The evaluation covers six models spanning diverse architectures, and compares SFT, universal DPO, oracle DPO, and calibrated DPO generator variants.Oracle DPO uses victim-specific preference signals; calibrated DPO substitutes proxy aggregation weighted by behavioral agreement within each specification region.Source: §A.7.1 · p. 18, §A.7.2 · p. 19

A.7.3 Judge Model Reliability

  • Final judge decisions agree with human annotations in 97.9% of a policy-balanced audit, but remaining errors concentrate at subtle policy boundaries.The two judges rarely overturn each other after critique, so the authors treat LLM-based evaluation as a limitation rather than a perfect oracle.Source: §A.7.3 · p. 20

A.8.1 Semi-unstructured vs Structured SFT

  • FinRT-SFT has higher ASR and RC-Coverage@10 than WT-Fin, whose training prompts covered 19% of the policy-domain space.WT-Fin nevertheless generalizes comparatively well at inference, indicating the efficiency of inverse elicitation despite limited training-specification coverage.Source: §A.8.1 · p. 20, Table 10 · p. 21

A.8.2 Calibration Budget Sensitivity

  • Increasing calibration coverage from 1% to 10% raises target-model ASR from 27.9% to 32.8%, with minimal gains beyond 10%.The result suggests relatively small calibration subsets can estimate localized proxy agreement reliably.Source: §A.8.2 · p. 20, Figure 8 · p. 20

A.8.3 Surrogate–Victim Mismatch in Forward Elicitation

  • Adding aligned-victim feedback improves FinRT-SFT by 0.9 ASR points and FinRT-DPO-calibrated by 0.2 points, supporting retention of the uncensored-model-only design.The uncensored model supplies a scalable, high-recall signal for broadly attackable behaviors; calibrated proxy optimization recovers most gains from aligned-victim feedback, which adds target-facing cost.Source: §A.8.3 · p. 21

A.9 Detailed attack analysis

  • Digital banking access × fraud reaches 62% ASR, while market abuse and data privacy are less attackable and vulnerability varies by conversational domain.Fraud, unauthorized financial activity, and debt collection remain vulnerable across multiple domains; conversational banking and payment contexts increase vulnerability for some policies relative to identity or compliance settings.Source: §A.9 · pp. 21–22
  • Credential exploitation, unauthorized financial activity, and fraud facilitation reach 48% overall ASR, versus 20–25% for manipulation-oriented behaviors.Behavioral difficulty rankings are broadly consistent across model families despite differences in absolute vulnerability; Mixtral and Llama-family models are more vulnerable across categories than Gemma-4-31B and GPT-OSS-20B.Source: §A.9 · p. 22
  • High-severity attacks cluster in a small subset of policy–domain contexts, including fraud and unauthorized transactions in payment, digital banking, and debt-collection domains.Unauthorized disclosure targets credit-reporting and identity-access contexts, while fairness- and advice-oriented behaviors have lower cumulative severity and remain more diffuse.Source: §A.9 · p. 22

Related papers

Loading 2609.36474v1…