Chasing Moving Targets with Online Self-Play Reinforcement Learning for Safer Language Models

TL;DR

This paper introduces Self-RedTeam, an online self-play reinforcement learning method where attacker and defender agents co-evolve to improve language model safety, achieving more diverse attacks and higher robustness through a game-theoretic framework.

Contribution

It presents a novel online self-play reinforcement learning approach for LM safety, with theoretical safety guarantees and empirical improvements over static defenses.

Findings

Uncovers 21.8% more diverse attacks compared to static defenders

Achieves 65.5% higher robustness on safety benchmarks

Introduces hidden Chain-of-Thought to enhance adversarial diversity

Abstract

Conventional language model (LM) safety alignment relies on a reactive, disjoint procedure: attackers exploit a static model, followed by defensive fine-tuning to patch exposed vulnerabilities. This sequential approach creates a mismatch -- attackers overfit to obsolete defenses, while defenders perpetually lag behind emerging threats. To address this, we propose Self-RedTeam, an online self-play reinforcement learning algorithm where an attacker and defender agent co-evolve through continuous interaction. We cast safety alignment as a two-player zero-sum game, where a single model alternates between attacker and defender roles -- generating adversarial prompts and safeguarding against them -- while a reward LM adjudicates outcomes. This enables dynamic co-adaptation. Grounded in the game-theoretic framework of zero-sum games, we establish a theoretical safety guarantee which motivates the design of our method: if self-play converges to a Nash Equilibrium, the defender will reliably produce safe responses to any adversarial input. Empirically, Self-RedTeam uncovers more diverse attacks (+21.8% SBERT) compared to attackers trained against static defenders and achieves higher robustness on safety benchmarks (e.g., +65.5% on WildJailBreak) than defenders trained against static attackers. We further propose hidden Chain-of-Thought, allowing agents to plan privately, which boosts adversarial diversity and reduces over-refusals. Our results motivate a shift from reactive patching to proactive co-evolution in LM safety training, enabling scalable, autonomous, and robust self-improvement of LMs via multi-agent reinforcement learning (MARL).