TreeTeaming: Autonomous Red-Teaming of Vision-Language Models via Hierarchical Strategy Exploration

Conference: CVPR 2026 arXiv: 2603.22882 Code: https://github.com/ChunXiaostudy/TreeTeaming Area: Multimodal VLM Keywords: Red-teaming, VLM safety, strategy exploration, jailbreak attack, autonomous discovery

TL;DR

TreeTeaming proposes an autonomous red-teaming framework that dynamically constructs and expands a strategy tree via an LLM-driven Orchestrator, autonomously discovering diverse VLM attack strategies from a single seed example. It achieves state-of-the-art attack success rates across 12 mainstream VLMs (87.60% on GPT-4o), while the discovered strategy diversity surpasses the union of all known publicly available strategies.

Background & Motivation

1. Background: VLM safety vulnerability discovery primarily relies on red-teaming. Existing approaches include manually designed attack templates (FigStep, MM-SafetyBench, etc.) and automated frameworks (Arondight, TRUST-VLM, etc.).
2. Limitations of Prior Work: All existing methods are constrained by a "predefined strategy" paradigm—each method is merely an instantiation of a manually designed attack heuristic. Even methods with feedback mechanisms (e.g., TRUST-VLM) can only refine test cases within an established strategy framework, and are incapable of discovering new strategies.
3. Key Challenge: Existing methods can only make "known attacks more effective," but cannot "systematically discover new attacks"—vulnerability exploration remains confined to a single path.
4. Goal: Shift the paradigm from static strategy testing to dynamic strategy discovery—automating the discovery of attack strategies themselves, rather than merely executing predefined ones.
5. Key Insight: Organize strategies hierarchically using a tree structure (concept → concrete strategy), allowing an LLM to autonomously decide whether to deepen existing paths or explore new branches.
6. Core Idea: Strategy tree + dynamic Orchestrator scheduling (exploitation/exploration trade-off) + multimodal Actuator execution + failure cause analysis feedback.

Method

Overall Architecture

TreeTeaming consists of three collaborative modules: (1) a strategy tree and Orchestrator to guide strategy evolution; (2) a multimodal Actuator and strategy consistency checker to create and validate test cases; (3) a failure cause analysis model to provide system-level feedback. Starting from a single seed example, the framework autonomously grows the full strategy tree.

Key Designs

1. Strategy Tree and Orchestrator:

   • Function: Organizes and tracks all explored attack strategies, dynamically scheduling exploitation/exploration.
   • Mechanism: The strategy tree is a hierarchical knowledge structure—root node (ultimate goal: inducing the VLM to generate unsafe content), parent nodes (strategy categories, e.g., "cognitive bias exploitation"), and leaf nodes (executable concrete strategies, maintaining ASR and exploitation budget). The Orchestrator determines exploitation (deepening existing high-ASR strategies) versus exploration (discovering new strategy branches) via a dynamic threshold \(\tau_{dynamic} = \max\{\tau_{initial} \cdot (1 - N_{total}/N_{max}), \tau_{min}\}\).
   • Design Motivation: The tree structure naturally supports hierarchical organization and multi-path exploration; the dynamic threshold enables a smooth transition from selective exploration to comprehensive exploitation.

2. Multimodal Actuator and Consistency Checker:

   • Function: Translates abstract strategies into concrete image-text test cases and validates their effectiveness.
   • Mechanism: The Actuator is equipped with 11 plug-and-play tools (text processing, image generation/editing, etc.) and generates concrete attack samples based on the selected leaf node strategy description. The consistency checker verifies whether the final sample aligns with the intended attack strategy, addressing "strategy drift"—ensuring generated tests actually execute the prescribed strategy.
   • Design Motivation: Translating abstract strategies into concrete attacks is prone to deviating from the original intent; consistency checking guarantees attack validity and attributability.

3. Failure Cause Analysis Model:

   • Function: Analyzes the reasons for attack failure and provides feedback for strategy evolution.
   • Mechanism: When an attack fails, the analysis model identifies the "dominant failure mode" (e.g., "the model detected typographically embedded content") and appends this information to the corresponding leaf node. When subsequently exploiting that strategy, the Orchestrator can guide the Actuator to circumvent known failure modes.
   • Design Motivation: Forms a closed-loop feedback cycle, giving strategy evolution directionality rather than blind trial-and-error.

Loss & Training

TreeTeaming is an inference-time framework and involves no training. Strategy exploration and test case generation are driven entirely by LLM inference.

Key Experimental Results

Main Results

Target VLM	TreeTeaming ASR%	Prev. SOTA ASR%	Gain
GPT-4o	87.60	Comparison methods	SOTA
Claude-3.5	SOTA	Comparison methods	Significant
Gemini-1.5	SOTA	Comparison methods	Significant
11 of 12 VLMs	SOTA	—	Comprehensive lead

Ablation Study

Configuration	Key Metric	Description
Fixed strategy (no tree)	Lower ASR	Executes only predefined strategies
Tree + exploitation only	Moderate ASR	Can deepen but cannot discover new strategies
Tree + exploitation + exploration	High ASR	Exploitation-exploration balance is most effective
+ Consistency checker	Higher effective ASR	Reduces strategy drift
+ Failure analysis feedback	Best	Closed-loop feedback yields further improvement

Key Findings

• The strategy diversity discovered by TreeTeaming surpasses the union of all known publicly available jailbreak strategies.
• Generated attacks exhibit an average toxicity reduction of 23.09%, rendering them more covert and harder to detect by safety filters.
• The strategy tree can autonomously grow a rich hierarchical attack strategy structure from a single seed.
• The linear decay of the dynamic threshold effectively realizes the early-exploration → late-exploitation transition.

Highlights & Insights

• The paradigm shift from "using predefined strategies" to "discovering strategies themselves" is the core contribution—a qualitative leap from linear optimization to tree-structured exploration.
• Strategy diversity surpassing human expert accumulation is impressive: the autonomous system discovers attack angles previously unconsidered by humans.
• The consistency checker addresses the common "strategy drift" problem in generative red-teaming, ensuring every test sample is traceable to a specific strategy.

Limitations & Future Work

• Relies on powerful LLMs as the Orchestrator, incurring high computational cost.
• Discovered attack strategies may be subject to misuse, necessitating careful disclosure policies.
• Evaluation is limited to safety refusal scenarios, excluding broader safety dimensions such as factual errors and biases.
• The scale of the strategy tree is constrained by the evaluation budget.

Related Work & Insights

• vs. TRUST-VLM: Automates test case generation within a fixed strategy framework; TreeTeaming automates the discovery of strategies themselves.
• vs. FigStep/MM-SafetyBench: Instantiate a single manually crafted strategy; TreeTeaming autonomously discovers a broader strategy space that subsumes these methods.
• vs. Arondight: Follows a fixed pipeline with limited strategy diversity; TreeTeaming achieves systematic strategy exploration through its tree structure.

Rating

• Novelty: ⭐⭐⭐⭐⭐ Paradigm shift from strategy execution to strategy discovery
• Experimental Thoroughness: ⭐⭐⭐⭐⭐ Large-scale evaluation across 12 VLMs
• Writing Quality: ⭐⭐⭐⭐ Clear framework with well-motivated design
• Value: ⭐⭐⭐⭐⭐ Establishes a new paradigm for VLM safety evaluation

Related Papers

• [CVPR 2026] LLaVAShield: Safeguarding Multimodal Multi-Turn Dialogues in Vision-Language Models
• [CVPR 2026] Dynamic Token Reweighting for Robust Vision-Language Models
• [CVPR 2026] HulluEdit: Single-Pass Evidence-Consistent Subspace Editing for Mitigating Hallucinations in Large Vision-Language Models
• [CVPR 2026] Diagnosing and Repairing Unsafe Channels in Vision-Language Models via Causal Discovery and Dual-Modal Safety Subspace Projection
• [CVPR 2026] Prune2Drive: A Plug-and-Play Framework for Accelerating Vision-Language Models in Autonomous Driving