Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

RADAR: A Risk-Aware Dynamic Multi-Agent Framework for LLM Safety Evaluation via Role-Specialized Collaboration

Xiuyuan Chen, Jian Zhao, Yuchen Yuan, Tianle Zhang, Huilin Zhou, Zheng Zhu, Ping Hu, Linghe Kong, Chi Zhang, Weiran Huang, Xuelong Li

TL;DR

RADAR addresses gaps in LLM safety evaluation due to evaluator biases and latent risk detection limitations. It introduces a risk-concept space and role-specialized, multi-agent debate with dynamic concept evolution to achieve robust, bias-resistant risk assessments. Empirical results on 800 challenging cases and public benchmarks show substantial improvements in accuracy, stability, and self-evaluation sensitivity, including a 28.87% improvement in risk identification over baselines. The work provides theoretical foundations and practical guidelines for scalable, robust jailbreaker risk evaluation and sets the stage for further optimization of role configurations and debate efficiency.

Abstract

Existing safety evaluation methods for large language models (LLMs) suffer from inherent limitations, including evaluator bias and detection failures arising from model homogeneity, which collectively undermine the robustness of risk evaluation processes. This paper seeks to re-examine the risk evaluation paradigm by introducing a theoretical framework that reconstructs the underlying risk concept space. Specifically, we decompose the latent risk concept space into three mutually exclusive subspaces: the explicit risk subspace (encompassing direct violations of safety guidelines), the implicit risk subspace (capturing potential malicious content that requires contextual reasoning for identification), and the non-risk subspace. Furthermore, we propose RADAR, a multi-agent collaborative evaluation framework that leverages multi-round debate mechanisms through four specialized complementary roles and employs dynamic update mechanisms to achieve self-evolution of risk concept distributions. This approach enables comprehensive coverage of both explicit and implicit risks while mitigating evaluator bias. To validate the effectiveness of our framework, we construct an evaluation dataset comprising 800 challenging cases. Extensive experiments on our challenging testset and public benchmarks demonstrate that RADAR significantly outperforms baseline evaluation methods across multiple dimensions, including accuracy, stability, and self-evaluation risk sensitivity. Notably, RADAR achieves a 28.87% improvement in risk identification accuracy compared to the strongest baseline evaluation method.

RADAR: A Risk-Aware Dynamic Multi-Agent Framework for LLM Safety Evaluation via Role-Specialized Collaboration

TL;DR

RADAR addresses gaps in LLM safety evaluation due to evaluator biases and latent risk detection limitations. It introduces a risk-concept space and role-specialized, multi-agent debate with dynamic concept evolution to achieve robust, bias-resistant risk assessments. Empirical results on 800 challenging cases and public benchmarks show substantial improvements in accuracy, stability, and self-evaluation sensitivity, including a 28.87% improvement in risk identification over baselines. The work provides theoretical foundations and practical guidelines for scalable, robust jailbreaker risk evaluation and sets the stage for further optimization of role configurations and debate efficiency.

Abstract

Existing safety evaluation methods for large language models (LLMs) suffer from inherent limitations, including evaluator bias and detection failures arising from model homogeneity, which collectively undermine the robustness of risk evaluation processes. This paper seeks to re-examine the risk evaluation paradigm by introducing a theoretical framework that reconstructs the underlying risk concept space. Specifically, we decompose the latent risk concept space into three mutually exclusive subspaces: the explicit risk subspace (encompassing direct violations of safety guidelines), the implicit risk subspace (capturing potential malicious content that requires contextual reasoning for identification), and the non-risk subspace. Furthermore, we propose RADAR, a multi-agent collaborative evaluation framework that leverages multi-round debate mechanisms through four specialized complementary roles and employs dynamic update mechanisms to achieve self-evolution of risk concept distributions. This approach enables comprehensive coverage of both explicit and implicit risks while mitigating evaluator bias. To validate the effectiveness of our framework, we construct an evaluation dataset comprising 800 challenging cases. Extensive experiments on our challenging testset and public benchmarks demonstrate that RADAR significantly outperforms baseline evaluation methods across multiple dimensions, including accuracy, stability, and self-evaluation risk sensitivity. Notably, RADAR achieves a 28.87% improvement in risk identification accuracy compared to the strongest baseline evaluation method.

Paper Structure

This paper contains 29 sections, 8 equations, 3 figures, 4 tables.

Table of Contents

  1. Introduction
  2. Related Work
  3. Methodology
  4. LLM Safety Evaluation
  5. Single LLM Evaluator
  6. Multiple LLM Evaluators
  7. Multi-Agent Collaborative LLM Safety Evaluation
  8. Specialized roles for safety evaluation
  9. Self-evolution risk-concept distribution
  10. Multi-round debate
  11. Experiments
  12. Datasets
  13. Baselines and Evaluator Configuration
  14. Accuracy Evaluation
  15. Stability Evaluation
  16. ...and 14 more sections

Figures (3)

  • Figure 1: The evaluation pipeline of RADAR. For a given evaluation task, SCA and VD first provide preliminary evaluation opinions, including conclusions and analysis. Subsequently, CAC critically examines the opinions from both evaluators in the current round and provides modification suggestions. Next, SCA and VD refine their respective opinions based on the suggestions from CAC. Finally, HA summarizes the entire debate process and delivers the final evaluation conclusion.
  • Figure 2: False Negative Rate (FNR) of Self-Evaluation and RADAR across four models.
  • Figure 3: Accuracy of RADAR as a function of the number of debate rounds and agents.