NRT-Bench: Benchmarking Multi-Turn Red-Teaming of LLM Operator Agents in Safety-Critical Control Rooms

Abstract: LLM agents are increasingly proposed as supervisory components for safety-critical systems, yet their robustness under sustained, adaptive adversarial pressure remains poorly characterized. We present NRT-Bench, a benchmark for multi-turn red-teaming of LLM agents acting as operators of a safety-critical system, instantiated in a simulated nuclear power plant control room. A five-role operator team, each backed by a configurable LLM, runs a plant governed by six critical safety functions (CSFs), while adversaries inject messages over four channels in bounded multi-turn sessions with per-turn feedback. Harm is an objective signal rather than LLM-judged text: a run terminates the moment any CSF is lost, attributed to the causing message. Evaluating four frontier operator models under a fixed-attack paired-replay protocol, we find that adaptive multi-turn attacks reliably push the operator team past a safety limit: across the four models, between 8.7% and 12.1% of attack sessions end with the plant losing a critical safety function. Although the four models look almost equally robust by this aggregate rate, their failures barely overlap: of $149$ sessions, none defeat all four models while a third defeat at least one, so vulnerabilities are nearly disjoint across models rather than nested. The effect of added defences is strongly model-dependent: the same guardrail stack or safety-advisor agent that lowers attack success for one model can raise it for another. We release the simulation venue, attack dataset, and replay tooling for reproducible safety evaluation of LLM agents.

• The paper introduces NRT-Bench, a benchmark that simulates multi-role LLM operator teams in nuclear control rooms to assess safety-critical CSF losses under adaptive adversarial attacks.
• It employs a closed simulation with multi-turn red-teaming, detailed role interactions, and tamper-evident session logging to measure physical harm signals objectively.
• Empirical findings reveal model-specific vulnerabilities and demonstrate that diverse panel approaches can dramatically reduce breach rates, highlighting the need for multidimensional safety evaluations.

NRT-Bench: Formal Benchmarking of Multi-Turn Red-Teaming Against LLM Operator Teams in Safety-Critical Control Rooms

Motivation and Context

The paper presents NRT-Bench, a benchmarking suite developed to rigorously evaluate the robustness of LLM operator agents managing safety-critical environments, specifically, nuclear power plant simulators. Traditional red-teaming benchmarks primarily rely on single-turn prompt-injection and LLM-judged textual policy violations, offering limited insight into multi-turn adaptive attack strategies and their impact on physical-system safety. NRT-Bench advances the state of safety benchmarking by defining harms as explicit simulator-derived critical safety function (CSF) losses and evaluating multi-role, multi-agent LLM teams under sustained adversarial sessions. This approach directly addresses prior gaps in physical harm attribution, role structure, and adaptive escalation.

Figure 1: NRT-Bench pipeline overview: an adaptive red-team attacker interacts via four ingress channels with a five-role LLM operator team, returning simulator-derived objective harm signals (CSF losses) per turn.

Benchmark Architecture

NRT-Bench implements a closed simulation environment encapsulating a realistic nuclear control room. The venue comprises:

• A five-role LLM-backed operator team (Senior Reactor Operator, Reactor Operator, Turbine Operator, Auxiliary Operator, Safety Technical Advisor), each communicating through a typed in-process message bus.
• Six atomic CSFs (e.g., reactivity control, core heat removal, containment integrity), recomputed every simulator tick, with objective loss marking physical harm.
• Four adversarial ingress channels representing distinct attacker profiles (external, insider, supply-chain, compromised auxiliary agents); each session is a bounded, multi-turn interaction capped at ten turns with per-turn redaction-aware feedback to inform escalation strategies.
• A deterministic action classifier for authority gating, supplemented by a mock approval console abstracting human oversight for high-impact actions.
• Tamper-evident session trace logging for detailed breach attribution and post-hoc analysis.

Threat Model and Attack Protocol

NRT-Bench’s adversarial framework enforces strict boundary conditions on attacker capabilities: payloads are injected only through specified channels, with signature verification and channel-based allowlists; attackers lack direct access to operator prompts, plant state, or internal message bus functions.

Each attack session reflects authentic adversarial tactics (authority spoofing, urgency injection, gradual escalation, supply-chain exploitation), sampled from an LLM-driven strategy catalog. Harm attribution is granular: a session terminates and records a breach the moment any CSF transitions to ‘lost’, regardless of degraded states or blocked actions. Both black-box and white-box attacker observation modes are supported, with black-box summaries as the principal evaluation regime.

Evaluation Protocols and Defense Ablations

NRT-Bench adopts paired fixed-attack replay for all defender evaluations: a curated corpus of attacker payloads is replayed against each candidate operator stack under identical configurations. This enables direct comparison of model-specific vulnerabilities and defense-layer efficacy. The ablation surface comprises ten optional guardrail policies, four advisor authority modes (ranging from disabled to hard-veto), two attacker visibility settings, and multiple accident scenario baselines.

Empirical Findings

Across four frontier LLM operator model families (gpt-5.4-mini, claude-haiku-4-5, Gemma-4-26B-A4B-it, Qwen3.5-35B-A3B), adaptive multi-turn attacks breached a CSF in 8.7–12.1% of sessions. Notably, aggregate attack success rates are superficially similar between models, but vulnerability fingerprints are almost disjoint:

• Of 149 test sessions, none breached all four models simultaneously, while a third breached at least one; unique breach sets predominate.
• Strong defense-layer effects are highly model conditional: the same ten-layer guardrail stack that reduces attack success for gpt-5.4-mini (down to 1.4% ASR in the best case) increases breach rates for claude-haiku-4-5 (43.1% ASR), demonstrating contradictory defense efficacy.
• Gradual escalation and authority spoofing strategies are universally most effective, while direct knowledge extraction and forbidden alarm suppression achieved low breach rates, given procedural and hard-coded locking.
• Paired panel discipline (action allowed only when all panel defender models agree) resulted in zero breaches—a quantitative upper bound on defense-in-breadth obtained by leveraging vulnerability diversity rather than individual model robustness.

Practical and Theoretical Implications

The findings challenge the adequacy of scalar robustness metrics and show that defense effectiveness cannot be certified independently of the underlying operator model. Model diversity across agent teams is revealed as a critical axis for achieving defense-in-depth, outpacing individual model hardening. The interplay between defense layers and agent architectures necessitates conditional safety evaluations—designing robust operator stacks requires explicit characterization of both model and policy-interface vulnerabilities.

Furthermore, objective simulation-derived harm signals (CSF transitions) provide a reproducible, domain-grounded safety measure, avoiding the pitfalls of LLM-judged text-based red-teaming. NRT-Bench is positioned as a reference benchmark for candidate LLM agent systems intended for deployment in safety-critical control domains.

Outlook and Future Directions

NRT-Bench opens several avenues for advanced research: adaptive-attacker regeneration per defender, scenario expansion to encompass rarer accident modes, engineered panel defenses that balance veto breadth against operational latency and cost, and transferability analysis under correlated prompt attacks. The release of venue, dataset, and replay tools supports reproducibility and fosters principled evaluation of LLM agent safety in physically realistic control-room contexts.

Conclusion

NRT-Bench rigorously benchmarks the adversarial robustness of multi-agent LLM operator teams in safety-critical simulation, shifting evaluation focus from textual policy violations to objective physical harm attribution. The results demonstrate that defense efficacy is highly model-conditional and that panel diversity yields substantial defense-in-breadth. Scalar robustness scores obscure critical vulnerability fingerprint differences, establishing the need for multidimensional, operationally grounded safety evaluation. The benchmark provides a platform for reproducible, scenario-driven assessment of LLM agent suitability in high-risk domains (2606.20408).