license: cc-by-4.0
language:

• en
  pretty_name: Adaptive Adversaries Benchmark
  size_categories:
• 10K<n<100K
  task_categories:
• text-generation
• other
  task_ids:
• language-modeling
• dialogue-modeling
  annotations_creators:
• machine-generated
• expert-generated
  language_creators:
• machine-generated
  source_datasets:
• original
  multilinguality:
• monolingual
  tags:
• red-teaming
• adversarial-evaluation
• llm-safety
• prompt-injection
• multi-turn
• benchmark
• agent-security
• jailbreaking
• responsible-ai
• croissant
  configs:
• config_name: transcripts
  data_files:
  • split: calibrated
    path: transcripts/*.jsonl
• config_name: competition_traces
  data_files:
  • split: private_scoring
    path: competition_traces/battles.jsonl.gz
• config_name: replay_corpus
  data_files:
  • split: replay
    path: replay_corpus/replay.jsonl

Adaptive Adversaries: A Multi-Turn, Multi-LLM Benchmark for LLM Agent Security

A 21-scenario multi-turn (15-round) adversarial red-teaming benchmark for LLM agents, in which both attacker and defender are independent LLM agents and attacks are regenerated per battle. Includes calibrated 3×3 attacker × defender matrix evaluation, full battle transcripts, attack-replay corpus, and traces from two open AgentBeats competitions.

Companion paper: Adaptive Adversaries: A Multi-Turn, Multi-LLM Benchmark for LLM Agent Security (NeurIPS 2026 Datasets & Benchmarks Track)

What's in this dataset

dataset/
├── README.md                       # this file
├── scenarios/                      # 21 private scenario plugins (Python)
├── public_scenarios/               # 10 public scenario plugins (Python)
├── transcripts/                    # 945 battle transcripts from the 3×3 N=5 matrix
│   ├── opus_vs_opus.jsonl          # one .jsonl per cell, 105 battles each
│   └── ... (9 cells × 21 scenarios × 5 runs)
├── 3x3_n=5/                        # per-cell evaluation outputs (9 files)
│   └── eval_<attacker>_vs_<defender>.json
├── replay_corpus/                  # 48 source attacks × 244 transfer attempts
├── competition_traces/             # 18,422 final-scoring + 93,291 public-iteration battles
├── competition_baseline_variability/   # per-team / per-scenario variability rollups
├── baseline_vs_baseline_n=50/      # 1,050 noise-floor battles on gpt-oss-20b
├── calibration/                    # calibration rubric (methodology)
│   └── rubric.md
├── croissant.json                  # MLCommons Croissant 1.0 manifest
├── DATASHEET.md, ERRATA.md, SCHEMA.md, LICENSE
└── load_and_test.py                # minimal HF datasets loader + sanity check

Quick start

Loading battle transcripts

Each transcripts/<cell>.jsonl file contains 105 battles (21 scenarios × 5 runs). Each line is one battle with the full multi-round battle log.

import json

with open("transcripts/opus_vs_opus.jsonl") as f:
    for line in f:
        battle = json.loads(line)
        print(battle["scenario"], battle["winner"], battle["manipulation_round"])
        # battle["battle_log"] is the list of 15 rounds with attack/defender outputs

Loading via 🤗 datasets

from datasets import load_dataset
ds = load_dataset("agentbeats/calibrated-adversarial-bench", "transcripts")
# Each cell is a config; e.g., ds["opus_vs_opus"]

Running new evaluations on the 21 scenarios

import sys
sys.path.append("scenarios/")
from gameguru import GameGuruPlugin

plugin = GameGuruPlugin({})
print(plugin.get_attack_objective())
print(plugin.get_defender_role())
print(plugin.get_output_format())

# Use plugin.check_success(defender_response) to evaluate your own model

Benchmark composition

21 scenarios across 12 application domains:

12 INJECTION-type (attacker payload embedded in processed data), 9 DIRECT-type (attacker conversational with defender).

Evaluation results

3×3 attacker × defender matrix at N=5 runs per cell, 15 rounds per battle, 945 battles total.

ASR with 95% bootstrap CIs. Overall: 12.8% [10.8, 15.0].

Six confirmed-robust scenarios (0/45 across all 9 cells × 5 runs): adattack, apikeybot, corpcomply, gitblamebot, inventorypoison, salarysleuth.

Calibration rubric (for use on new scenarios)

We score each scenario across 4 dimensions and apply compound penalty flags. See calibration/rubric.md.

Compound penalty flags: BAL_0, BAL_100, SVW_0, NO_DIFF, WVS_HIGH, INVERTED.

Typed-field judge design principle

Adversarial judges should check specific JSON output fields (the result fields), not free-text prose, and not the defender's reasoning fields. The released check_success implementations enforce this.

Defender failure mechanism taxonomy (A–F)

For analyzing why a defender failed (orthogonal to the scenario type):

Per-defender mechanism profiles for the 3 frontier models we evaluated:

Citation

@inproceedings{agentbeats2026,
  title={Calibrating Adversarial AI Benchmarks: A Methodology for Reliable Multi-Turn Red-Teaming Evaluation},
  author={...},
  booktitle={NeurIPS 2026 Datasets and Benchmarks Track},
  year={2026}
}

License

MIT for the benchmark code and documentation. Battle transcripts are released under CC-BY-4.0.

Origin

The benchmark scenarios originate in the AgentBeats Security Arena public red-teaming competition (2025). 51 participant submissions across 12 teams formed the ideation pool; we curated, calibrated, and refined 21 final scenarios using the methodology in the paper.

Limitations

• N=5 per cell — categorical findings (compromised on at least one run, never compromised) are robust; per-cell point-estimate comparisons have 8–12pp CIs.
• 3 model families evaluated. Methodology is the contribution; matrix scale is intentionally small.
• Scenarios are publicly released — production-system evaluators must recognize that future model training may include these.
• Harness ablation is left for future work; verbatim competition-team harnesses are intentionally not redistributed (see DATASHEET).

Contact

Anonymous authors — NeurIPS 2026 Datasets & Benchmarks Track submission.