DREAM: Dynamic Red-teaming across Environments for AI Models (2512.19016v1)

Abstract: LLMs are increasingly used in agentic systems, where their interactions with diverse tools and environments create complex, multi-stage safety challenges. However, existing benchmarks mostly rely on static, single-turn assessments that miss vulnerabilities from adaptive, long-chain attacks. To fill this gap, we introduce DREAM, a framework for systematic evaluation of LLM agents against dynamic, multi-stage attacks. At its core, DREAM uses a Cross-Environment Adversarial Knowledge Graph (CE-AKG) to maintain stateful, cross-domain understanding of vulnerabilities. This graph guides a Contextualized Guided Policy Search (C-GPS) algorithm that dynamically constructs attack chains from a knowledge base of 1,986 atomic actions across 349 distinct digital environments. Our evaluation of 12 leading LLM agents reveals a critical vulnerability: these attack chains succeed in over 70% of cases for most models, showing the power of stateful, cross-environment exploits. Through analysis of these failures, we identify two key weaknesses in current agents: contextual fragility, where safety behaviors fail to transfer across environments, and an inability to track long-term malicious intent. Our findings also show that traditional safety measures, such as initial defense prompts, are largely ineffective against attacks that build context over multiple interactions. To advance agent safety research, we release DREAM as a tool for evaluating vulnerabilities and developing more robust defenses.

• The paper demonstrates that dynamic, multi-environment red-teaming exposes hidden vulnerabilities in autonomous LLM agents using a PO-MDP based search strategy.
• It employs a Conductor Agent with Contextualized Guided Policy Search and a Cross-Environment Adversarial Knowledge Graph to enable multi-step, context-aware attack chains.
• Empirical validation shows super-linear damage accumulation through compounded cross-environment exploits, underscoring the need for persistent, stateful safety defenses.

Dynamic Red-Teaming across Environments (DREAM) for Systemic AI Agent Vulnerability Discovery

Motivation and Problem Landscape

Autonomous LLM-driven agents present complex, emergent safety risks as they interact with diverse tools and environments. Prior safety benchmarks are constrained by their static, single-environment, or single-turn adversarial probes, lacking the ability to stress-test the system under realistic adversarial persistence and cross-context exploit chains. Existing benchmarks thus fail to capture vulnerabilities emerging from (1) causal linkage of atomic actions, (2) information transfer and reuse across environment boundaries, and (3) context build-up over multi-turn engagements, collectively forming the operational substrate for real-world incident scenarios.

Figure 1: Traditional benchmarks (left) provide only local evaluation; DREAM’s dynamic, cross-environment red-teaming (right) introduces multi-agent attackers that operate synergistically, exposing vulnerabilities missed by single-environment testing.

DREAM addresses these limitations by operationalizing a dynamic, multi-stage, cross-environment red-teaming methodology for agentic LLM systems. It explicitly targets systemic failure modes arising from "contextual fragility"—the breakdown of safety protocols under context drift or long-term malicious intent that evades defense mechanisms restricted to static context windows.

DREAM Framework Architecture

The DREAM pipeline formalizes red-teaming as a policy search in a Partially Observable Markov Decision Process (PO-MDP) instantiated over an environment space $\mathcal{E}$, using a library of 1,986 atomically defined attack actions spanning 349 digital environments. The framework architecture comprises:

• Conductor Agent: Executes strategic planning and attack selection via Contextualized Guided Policy Search (C-GPS), operating over a state representation fused from continuous feedback.
• Unified Sandbox: Manages interaction state, simulating heterogeneous environment states, and executes/prompts atom attacks with context provisioned from the evolving knowledge graph.
• Cross-Environment Adversarial Knowledge Graph (CE-AKG): Maintains stateful symbolic tracking of acquired entities, causal dependencies, and enables information fusion across domains.
• Action Generation and Role Abstraction: Atom attacks are constructed via multi-agent role abstraction (Scout for reconnaissance, Seeder for environment manipulation, Exploiter for goal realization), expanding the adversarial action space with a diverse array of exploit primitives.

  Figure 2: DREAM framework overview: left—multi-agent attack generation; center—C-GPS planning and dynamic chain execution; right—cross-environment chain coordination and CE-AKG-powered context transfer.

Methodological Advances

DREAM’s distinctive technical contributions include:

• Attack Chain Generation as PO-MDP Search: The Conductor maintains a belief state over latent system properties, dynamically updates with LLM-extracted entities, and backtracks on failed paths. Actions are chosen to maximize a compound value function incorporating intrinsic exploitability, context/entity reuse, and strategic advancement (e.g., privilege escalation, successful environment pivot).
• Dynamic Contextual Planning: The policy search is both feedback-driven (adapting to stochastic agent responses) and stateful, with CE-AKG provision bridging semantic entities across traditionally siloed environments.
• Quantitative Scoring and Robustness Metrics: Attack chains are scored by cumulative discounted reward (with penalties), reflecting not just isolated breach success but compounded impact via multi-turn exploitation.
• Heuristic-Driven Search with Backtracking: C-GPS walks, clusters, and resamples candidate actions based on evolving global context, balancing exploration of cross-environment pivots with exploitation of local vulnerabilities.

Experimental Validation and Empirical Insights

Attack Efficacy: Domino and Information Bridge Effects

Empirical results on 12 SOTA LLM agents (including both proprietary and open-source) demonstrate that DREAM exposes vulnerabilities with high ASR (attack success rate) for most models—exceeding 70% for 8/12 agents—even when traditional benchmarks report strong safety.

Figure 3: Chain length vs. mean final attack score (solid) shows steep super-linear growth, evidencing the “domino effect”: vulnerability severity scales synergistically with chain length due to effective causal chaining.

• Super-linear Damage Accumulation: The domino effect is empirically validated; as attack chain length increases, the score distribution mean and variance both rise sharply, substantially outpacing exponential baseline models. This demonstrates that exploit chains yield synergistic, not merely additive, adversarial outcomes.
• Cross-Environment Pivot Amplification: Evaluation of attack chains traversing an increasing number of environments confirms “information bridge” effects—context transfer via CE-AKG results in a monotonic increase in adversarial leverage, with high-severity exploits manifesting only in the multi-context regime.

  Figure 4: Final attack score grows nearly linearly with number of environments traversed, confirming CE-AKG’s ability to fuse disparate context and enable multi-domain exploits.

Statistical testing (Wilcoxon signed-rank, $p < 0.001$ for chains of length $\geq 2$ or cross-environment count $\geq 2$) confirms that DREAM’s multi-step chains are significantly and consistently more effective than baseline single-step attacks.

Contextual Fragility and Inefficacy of Static Defenses

• Contextual Fragility: The majority of models exhibit low contextual isolation, indicating failure to prevent context drift between environments and thus susceptibility to long-range, causally-built exploits.
• Static Safety Prompt Limitations: Introducing explicit safety instructions degrades overall defense, increasing attack success rates, as static prompts are diluted by context accretion with each turn. This directly evidences failure in context tracking of malicious intent.

Attack Structure and Failure Modes

• Failure Mode Taxonomy: Most critical failures relate to “Ignoring implicit risks” and “Excessive trust in tool results.” Notably, almost all agents, regardless of origin, are highly vulnerable to “paralysis” (failure to call necessary tools) under multi-stage attack pressure.
• Role of Conductor Capability: Ablation studies reveal a universal positive chain length–severity correlation, but higher-capability Conductors (e.g., advanced Gemini variants) generate steeper exploit trajectories. Attacker sophistication thus dictates the upper bound of achievable adversarial impact.

  Figure 5: Across Conductors of variable LLM strength, attack chain length universally correlates with severity, but higher-performing Conductors accelerate severity growth, stratifying models’ robustness.

Per-Model and Per-Complexity Analysis

• Model-Class Heterogeneity: Fine-grained analysis shows diverse vulnerability profiles—e.g., some models fail catastrophic “data leakage” attacks, while others are uniquely vulnerable on context-rich “vulnerable code” or “paralysis” exploits.
• Attack Complexity Sensitivity: Both per-model breakdown by chain complexity and by cross-environment count illustrate that as attack sophistication increases, defenses erode heterogeneously, calling for targeted mitigation strategies.

  Figure 6: Per-model score distribution vs. number of pivots—model vulnerability heterogeneity manifests as chain complexity increases.

  

  Figure 7: Attack effectiveness increases strongly with chain length across all models and Conductors, affirming the generality of the domino effect.

Broader Implications and Future AI Safety Developments

DREAM exposes systemic weaknesses in current agent architectures: single-step evaluation, static safety prompts, and lack of persistent context tracking are all ineffective against the demonstrated threat model. Defense paradigms must evolve to implement stateful, history-aware detection, contextual isolation, and robust long-horizon adversarial understanding.

Practical implications include:

• Necessity for cross-environment context guards: Robust agent architectures must not only enforce environment-local policies but also detect entity provenance and causal linkage across boundary crossings.
• Integration of dynamic, multi-step red-teaming in the AI model/agent lifecycle: Safety benchmarks should no longer rely solely on static or randomly generated attack templates but should systematically stress agents using adversarial simulations such as DREAM.
• Research direction: Promising vectors include the development of persistent world-model-based defense agents, training objectives penalizing context drift, and continual safety auditing using dynamically generated exploit chains.
• Open science alignment: The DREAM framework and datasets, once released, will provide a reusable, extensible benchmark for the community to evaluate both offense and defense in complex agentic settings.

Conclusion

DREAM redefines agent safety evaluation by automating dynamic, multi-stage, cross-environment adversarial testing for LLM-based agents, exposing critical vulnerabilities hidden to previous, static methodologies. The findings demonstrate that contextual fragility, lack of long-horizon malicious intent tracking, and failure to isolate or coalesce context across environments are endemic weaknesses. Future developments in agent safety must operationalize long-term stateful defenses to address these adversarial challenges posed by persistent, adaptive attackers (2512.19016).