Non-Monotonic Safety Alignment Across Gemma Generations: A Quality-Diversity Red-Teaming Study

원문 초록

Note on v2 (Nov 2026): attack success now requires a response judged non-refusing and harmful (v1 counted every non-refusal), so all rates are lower; v1's figures are reported as the non-refusal rate, and with 3 seeds no significance claims are made. Safety alignment in LLMs need not improve monotonically across model generations. Studying four generations of Google's Gemma family (7B-31B) with quality-diversity evolution (MAP-Elites) as an automated red-teaming probe, we find that Gemma 3 (12B) has the highest attack success rate (ASR; response judged non-refusing and harmful): 33.7% +/- 1.3% (mean +/- std, 3 seeds), against 19.0% +/- 10.6% for Gemma 2 and 12.3% +/- 4.2% for Gemma 4. Every Gemma 3 seed exceeds every Gemma 2 and Gemma 4 seed, which we report as directional evidence. Harmful successes rarely transfer between generations (1.4-7.9% ASR when archives are replayed on other generations), lowest on Gemma 4 (1.4-2.8%). Cybercrime is the most exploited category in Gemma 1-3 (47-83%) but falls to 2% in Gemma 4, while misinformation rises from 17% (Gemma 2) to 80% (Gemma 3) and is still 53% in Gemma 4. A second-judge audit (Llama-3.1-70B) confirms 74% of the 8B judge's harmful labels. The non-refusal rate shows the same ordering at 2-3x higher levels and overstates harmful transfer by 6-16x. Code and artifacts: https://github.com/bassrehab/red-queen