{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,1,17]],"date-time":"2026-01-17T07:53:38Z","timestamp":1768636418990,"version":"3.49.0"},"reference-count":62,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","license":[{"start":{"date-parts":[[2026,1,1]],"date-time":"2026-01-01T00:00:00Z","timestamp":1767225600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2026,1,1]],"date-time":"2026-01-01T00:00:00Z","timestamp":1767225600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2026,1,1]],"date-time":"2026-01-01T00:00:00Z","timestamp":1767225600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62376284"],"award-info":[{"award-number":["62376284"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans.Inform.Forensic Secur."],"published-print":{"date-parts":[[2026]]},"DOI":"10.1109\/tifs.2025.3626228","type":"journal-article","created":{"date-parts":[[2025,10,28]],"date-time":"2025-10-28T17:32:49Z","timestamp":1761672769000},"page":"1006-1020","source":"Crossref","is-referenced-by-count":1,"title":["Disguise While Defense: Avoid Refusal Responses in LLM\u2019s Defense via a Multi-Agent Attacker\u2013Disguiser Game"],"prefix":"10.1109","volume":"21","author":[{"ORCID":"https:\/\/orcid.org\/0009-0009-6501-8686","authenticated-orcid":false,"given":"Qianqiao","family":"Xu","sequence":"first","affiliation":[{"name":"National University of Defense Technology, Changsha, Hunan, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-8906-5198","authenticated-orcid":false,"given":"Zhiliang","family":"Tian","sequence":"additional","affiliation":[{"name":"National University of Defense Technology, Changsha, Hunan, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Hongyan","family":"Wu","sequence":"additional","affiliation":[{"name":"National University of Defense Technology, Changsha, Hunan, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-4819-373X","authenticated-orcid":false,"given":"Zhen","family":"Huang","sequence":"additional","affiliation":[{"name":"National University of Defense Technology, Changsha, Hunan, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-5673-6605","authenticated-orcid":false,"given":"Dong","family":"Liang","sequence":"additional","affiliation":[{"name":"National University of Defense Technology, Changsha, Hunan, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-3277-6351","authenticated-orcid":false,"given":"Yiping","family":"Song","sequence":"additional","affiliation":[{"name":"National University of Defense Technology, Changsha, Hunan, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Ziyi","family":"Pan","sequence":"additional","affiliation":[{"name":"National University of Defense Technology, Changsha, Hunan, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Feng","family":"Liu","sequence":"additional","affiliation":[{"name":"National University of Defense Technology, Changsha, Hunan, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-9743-2034","authenticated-orcid":false,"given":"Dongsheng","family":"Li","sequence":"additional","affiliation":[{"name":"National University of Defense Technology, Changsha, Hunan, China"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"263","reference":[{"key":"ref1","article-title":"GPT-4 technical report","volume-title":"arXiv:2303.08774","author":"Achiam","year":"2023"},{"key":"ref2","first-page":"337","article-title":"Using large language models to simulate multiple humans and replicate human subject studies","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Aher"},{"key":"ref3","article-title":"Red-teaming large language models using chain of utterances for safety-alignment","author":"Bhardwaj","year":"2023","journal-title":"arXiv:2308.09662"},{"key":"ref4","first-page":"195","article-title":"Planning, learning and coordination in multiagent decision processes","volume-title":"Proc. 6th Conf. Theor. Aspects Rationality Knowl.","author":"Boutilier"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1016\/S0004-3702(02)00121-2"},{"key":"ref6","first-page":"1877","article-title":"Language models are few-shot learners","volume-title":"Proc. NIPS","author":"Brown"},{"key":"ref7","article-title":"Sparks of artificial general intelligence: Early experiments with GPT-4","author":"Bubeck","year":"2023","journal-title":"arXiv:2303.12712"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2024.acl-long.568"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1109\/MIS.2012.47"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1109\/SaTML64287.2025.00010"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2021.emnlp-main.629"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2023.findings-emnlp.143"},{"key":"ref13","article-title":"MasterKey: Automated jailbreak across multiple large language model chatbots","author":"Deng","year":"2023","journal-title":"arXiv:2307.08715"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1109\/ACCESS.2018.2831228"},{"key":"ref15","article-title":"Red teaming language models to reduce harms: Methods, scaling behaviors, and lessons learned","author":"Ganguli","year":"2022","journal-title":"arXiv:2209.07858"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2024.naacl-long.107"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.5555\/2969033.2969125"},{"key":"ref18","first-page":"555","article-title":"Suspicion agent: Playing imperfect information games with theory of mind aware GPT-4","volume-title":"Proc. 1st Conf. Lang. Model.","author":"Guo"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1145\/3670865.3673513"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1109\/TETCI.2024.3383454"},{"key":"ref21","article-title":"Baseline defenses for adversarial attacks against aligned language models","author":"Jain","year":"2023","journal-title":"arXiv:2309.00614"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1109\/SPW63631.2024.00018"},{"key":"ref23","first-page":"1012","article-title":"Certifying LLM safety against adversarial prompting","volume-title":"Proc. 1st Conf. Lang. Model.","author":"Kumar"},{"key":"ref24","article-title":"Global convergence of multi-agent policy gradient in Markov potential games","volume-title":"Proc. ICLR Workshop Gamification Multiagent Solutions","author":"Leonardos"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1016\/B978-1-55860-335-6.50027-1"},{"key":"ref26","article-title":"AutoDAN: Generating stealthy jailbreak prompts on aligned large language models","volume-title":"Proc. 12th Int. Conf. Learn. Represent.","author":"Liu"},{"key":"ref27","article-title":"Prompt injection attack against LLM-integrated applications","author":"Liu","year":"2023","journal-title":"arXiv:2306.05499"},{"key":"ref28","article-title":"Evolving diverse red-team language models in multi-round multi-agent games","author":"Ma","year":"2023","journal-title":"arXiv:2310.00322"},{"key":"ref29","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-70879-4_6"},{"key":"ref30","article-title":"Bergeron: Combating adversarial attacks through a conscience-based alignment framework","author":"Pisano","year":"2023","journal-title":"arXiv:2312.00029"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2020.acl-main.170"},{"key":"ref32","article-title":"Fine-tuning aligned language models compromises safety, even when users do not intend to!","volume-title":"Proc. ICLR","author":"Qi"},{"key":"ref33","article-title":"Improving language understanding by generative pre-training","author":"Radford","year":"2018"},{"issue":"8","key":"ref34","first-page":"9","article-title":"Language models are unsupervised multitask learners","volume":"1","author":"Radford","year":"2019","journal-title":"OpenAI blog"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1162\/tacl_a_00434"},{"key":"ref36","article-title":"Large language model alignment: A survey","author":"Shen","year":"2023","journal-title":"arXiv:2309.15025"},{"key":"ref37","first-page":"8634","article-title":"Reflexion: Language agents with verbal reinforcement learning","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Shinn"},{"key":"ref38","first-page":"1057","article-title":"Policy gradient methods for reinforcement learning with function approximation","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"12","author":"Sutton"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1007\/s10458-005-3783-9"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2021.3069908"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1038\/s42256-023-00765-8"},{"key":"ref42","doi-asserted-by":"publisher","DOI":"10.3390\/e25040605"},{"key":"ref43","article-title":"ReAct: Synergizing reasoning and acting in language models","volume-title":"Proc. 11th Int. Conf. Learn. Represent.","author":"Yao"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.1007\/s11633-023-1454-4"},{"key":"ref45","article-title":"GPTFUZZER: Red teaming large language models with auto-generated jailbreak prompts","author":"Yu","year":"2023","journal-title":"arXiv:2309.10253"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2024.acl-long.481"},{"key":"ref47","article-title":"WebArena: A realistic web environment for building autonomous agents","volume-title":"Proc. 12th Int. Conf. Learn. Represent.","author":"Zhou"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.1109\/TNNLS.2020.3041469"},{"key":"ref49","article-title":"Jailbreak attacks and defenses against large language models: A survey","author":"Yi","year":"2024","journal-title":"arXiv:2407.04295"},{"key":"ref50","doi-asserted-by":"publisher","DOI":"10.1145\/3658644.3670388"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2025.acl-long.1045"},{"key":"ref52","article-title":"Universal and transferable adversarial attacks on aligned language models","author":"Zou","year":"2023","journal-title":"arXiv:2307.15043"},{"key":"ref53","first-page":"48439","article-title":"AdvPrompter: Fast adaptive adversarial prompting for LLMs","volume-title":"Proc. 42nd Int. Conf. Mach. Learn.","author":"Paulus"},{"key":"ref54","article-title":"GUARD: Role-playing to generate natural-language jailbreakings to test guideline adherence of large language models","volume-title":"Proc. ICLR Workshop Secure Trustworthy Large Lang. Models","author":"Jin"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.52202\/079017-1952"},{"key":"ref56","article-title":"Llama guard: LLM-based input\u2013output safeguard for human-AI conversations","author":"Inan","year":"2023","journal-title":"arXiv:2312.06674"},{"key":"ref57","doi-asserted-by":"publisher","DOI":"10.1145\/3690635"},{"key":"ref58","first-page":"20640","article-title":"RStar-math: Small LLMs can master math reasoning with self-evolved deep thinking","volume-title":"Proc. 42nd Int. Conf. Mach. Learn.","author":"Guan"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.11613\/BM.2012.031"},{"key":"ref60","article-title":"GPT-4 is too smart to be safe: Stealthy chat with LLMs via cipher","volume-title":"Proc. 12th Int. Conf. Learn. Represent.","author":"Yuan"},{"key":"ref61","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2025.findings-naacl.16"},{"key":"ref62","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2025.acl-long.1045"}],"container-title":["IEEE Transactions on Information Forensics and Security"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/10206\/11313711\/11218933.pdf?arnumber=11218933","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,1,16]],"date-time":"2026-01-16T20:49:01Z","timestamp":1768596541000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11218933\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026]]},"references-count":62,"URL":"https:\/\/doi.org\/10.1109\/tifs.2025.3626228","relation":{},"ISSN":["1556-6013","1556-6021"],"issn-type":[{"value":"1556-6013","type":"print"},{"value":"1556-6021","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026]]}}}