RainbowPlus: Enhancing Adversarial Prompt Generation via Evolutionary Quality-Diversity Search
Quy-Anh Dang, Chris Ngo, Truong-Son Hy
TL;DR
RainbowPlus reframes adversarial prompt generation for large language models as an adaptive evolutionary quality-diversity search, addressing scalability and diversity limitations of prior red-teaming methods. It introduces a multi-element archive that stores multiple high-quality prompts per behavioral niche and replaces pairwise scoring with a probabilistic fitness evaluation, enabling batch assessment of prompts and a linear-time search complexity. Across six benchmarks and twelve LLMs, RainbowPlus achieves higher attack success rates and maintains a Diverse-Score around 0.84, generating orders of magnitude more prompts than prior approaches while often reducing runtime (e.g., ~1.45 hours on HarmBench vs ~13.5 hours for AutoDAN-Turbo). The open-source implementation supports reproducibility and further research in LLM safety, highlighting RainbowPlus as a scalable tool for comprehensive vulnerability assessment and red-teaming workflow optimization.
Abstract
Large Language Models (LLMs) exhibit remarkable capabilities but are susceptible to adversarial prompts that exploit vulnerabilities to produce unsafe or biased outputs. Existing red-teaming methods often face scalability challenges, resource-intensive requirements, or limited diversity in attack strategies. We propose RainbowPlus, a novel red-teaming framework rooted in evolutionary computation, enhancing adversarial prompt generation through an adaptive quality-diversity (QD) search that extends classical evolutionary algorithms like MAP-Elites with innovations tailored for language models. By employing a multi-element archive to store diverse high-quality prompts and a comprehensive fitness function to evaluate multiple prompts concurrently, RainbowPlus overcomes the constraints of single-prompt archives and pairwise comparisons in prior QD methods like Rainbow Teaming. Experiments comparing RainbowPlus to QD methods across six benchmark datasets and four open-source LLMs demonstrate superior attack success rate (ASR) and diversity (Diverse-Score $\approx 0.84$), generating up to 100 times more unique prompts (e.g., 10,418 vs. 100 for Ministral-8B-Instruct-2410). Against nine state-of-the-art methods on the HarmBench dataset with twelve LLMs (ten open-source, two closed-source), RainbowPlus achieves an average ASR of 81.1%, surpassing AutoDAN-Turbo by 3.9%, and is 9 times faster (1.45 vs. 13.50 hours). Our open-source implementation fosters further advancements in LLM safety, offering a scalable tool for vulnerability assessment. Code and resources are publicly available at https://github.com/knoveleng/rainbowplus, supporting reproducibility and future research in LLM red-teaming.