Research map / Multi-agent systems and games / LLM agents

RedDebate: Safer Responses Through Multi-Agent Red Teaming Debates

ICML 2026 · Multi-agent systems and games › LLM agents · approach: Self-evolving language agent learning · 2 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes RedDebate, a fully automated multi-agent debate framework where LLM debaters critique each other under red-teaming prompts, with an evaluator, feedback generator, and four long-term memory variants (textual, parametric, unified, guardrails) to reduce unsafe outputs.

Problem

LLMs produce unsafe responses under red-teaming prompts; existing safety methods rely on costly human red-teaming, training-time alignment, or single-agent self-critique that fails to catch its own blind spots.

Approach

Multi-agent debate among heterogeneous LLMs used as an automated red-teaming loop: an independent evaluator flags unsafe turns, a feedback generator distills lessons, and these are stored in short- and long-term memory (vector retrieval, LoRA fine-tuning, Colang guardrails) to improve later debates at inference time.

Key results

• SReD with unified LTM reduces HarmBench total error rate from 21.0% (SReD without memory) to 6.1% in the Mistral/Llama/Phi triad, and SReD+GLTM reaches 3.6%.
• On the Gemma/Qwen/R1 triad, SReD+GLTM reduces HarmBench total error from 28.9% to 0.2%, versus 32.9%-37.0% for self-revision and 8.3% for self-critique with memory.
• Debate alone reduces HarmBench error rate versus standard prompting (e.g., SP 38.7% to SReD 21.0% in the first triad), while the authors report up to 17.7% reduction with debate alone and over 23.5% with memory.

Surprising findings

• Strongly aligned GPT-OSS-20B achieves the lowest overall error rate mainly by refusing to engage in debate, making it passive toward unsafe peers.
• Self-critique can increase error at intermediate steps for some models, and even with matched token budgets it underperforms three-round debate.

Limitations

• Relies on LlamaGuard as the safety evaluator, which agrees with human labels only 87% accuracy on 315 arguments, and memory poisoning risks are not empirically evaluated.
• NeMo Guardrails Colang formatting causes runtime errors for some models such as Phi.
• Experiments disable reasoning/thinking mode for Qwen and DeepSeek-R1 and cap responses at 512 tokens.

Experimental setup

Datasets: HarmBench CoSafe Aegis-2 WildJailbreak TriviaQA XSTest

Benchmarks: HarmBench CoSafe Aegis-2 WildJailbreak TriviaQA XSTest

Metrics: error rate agreement rate refusal rate accuracy

Baselines: Standard Prompting Self-Revision Self-Critique PReD DAReD Best-of-N sampling

Builds on: multi-agent debate constitutional AI reflexion NeMo Guardrails LoRA

Closest papers by meaning

• Automated Red Teaming with GOAT: the Generative Offensive Agent Tester (ICML 2025 · similarity 0.89)
• Should we be going MAD? A Look at Multi-Agent Debate Strategies for LLMs (ICML 2024 · similarity 0.88)
• Learning Diverse Attacks on Large Language Models for Robust Red-Teaming and Safety Tuning (ICLR 2025 · similarity 0.88)
• Efficient Multi-Agent Reasoning via Confidence-Guided Adaptive Debate (ICML 2026 · similarity 0.88)
• DiveR-CT: Diversity-enhanced Red Teaming Large Language Model Assistants with Relaxing Constraints (AAAI 2025 · similarity 0.88)
• CoP: Agentic Red-teaming for Large Language Models using Composition of Principles (NeurIPS 2025 · similarity 0.88)