Research map / Large language models / Reasoning and chain of thought

Metis: Learning to Jailbreak LLMs via Self-Evolving Metacognitive Policy Optimization

ICML 2026 · Large language models › Reasoning and chain of thought · approach: Test-time compute scaling · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes Metis, a training-free multi-turn jailbreak agent that frames red teaming as inference-time policy optimization in an adversarial POMDP, using a DeepSeek-R1 attacker with a GPT-4o metacognitive evaluator, reporting 89.2% average ASR on HarmBench across 10 targets.

Problem

Automated red teaming of LLMs relies on static heuristics or stochastic search, which generalizes poorly to highly aligned frontier models and is token-expensive.

Approach

Cast jailbreaking as inference-time policy optimization in an adversarial POMDP; an attacker performs metacognitive [think]/[strategy]/[prompt] steps, while an evaluator returns structured feedback (score, justification, meta-suggestion) used as a "semantic gradient" to refine the attack within a single linear conversation.

Key results

• Metis achieves 89.2% average ASR on HarmBench across 10 target models, vs. 82.0% for the strongest baseline X-Teaming.
• On AdvBench Metis averages 85.8% ASR, with 76.0% on O1 and 78.0% on GPT-5-chat on HarmBench.
• Token cost to success is reduced by an average 8.2x (up to 11.4x) relative to X-Teaming on frontier models.

Surprising findings

• Removing the Evaluator's metacognitive feedback drops Claude-3.7 ASR from 86% to 46%, more than removing Attacker metacognition.
• Using a weaker Evaluator (Qwen2.5-7B) collapses GPT-4o ASR from 93% to 30% even with a strong DeepSeek-R1 attacker.

Limitations

• Success requires a strict score of 10 from a GPT-4o judge, and judge agreement with human experts is only 76.8% on average.
• Evaluation is limited to a fixed T_max=5 budget for comparisons and relies on API-hosted closed models with unclear versions.
• Dual-use risk; full framework and un-sanitized trajectories are released only on a case-by-case basis.

Experimental setup

Datasets: HarmBench AdvBench

Benchmarks: HarmBench AdvBench

Metrics: Attack Success Rate Average Queries to Success Average Total Tokens to Success agreement rate

Baselines: GCG PAP PAIR CodeAttack CipherChat AutoDAN-Turbo Crescendo CoA ActorBreaker X-Teaming

Builds on: X-Teaming ActorBreaker AutoDAN-Turbo Crescendo

Closest papers by meaning

• MetaCipher: A Time-Persistent and Universal Multi-Agent Framework for Cipher-Based Jailbreak Attacks for LLMs (AAAI 2026 · similarity 0.90)
• Jailbreak Antidote: Runtime Safety-Utility Balance via Sparse Representation Adjustment in Large Language Models (ICLR 2025 · similarity 0.90)
• Adversarial Reasoning at Jailbreaking Time (ICML 2025 · similarity 0.89)
• WildTeaming at Scale: From In-the-Wild Jailbreaks to (Adversarially) Safer Language Models (NeurIPS 2024 · similarity 0.89)
• MetaDefense: Defending Fine-tuning based Jailbreak Attack Before and During Generation (NeurIPS 2025 · similarity 0.89)
• Safety Recovery in Reasoning Models Is Only a Few Early Steering Steps Away (ICML 2026 · similarity 0.89)