{"type":"ScholarlyArticle","title":"Stay in Character, Stay Safe: Dual-Cycle Adversarial Self-Evolution for Role-Playing Agents","authors":[{"name":"Mingyang Liao","slug":"mingyang-liao","given":"Mingyang","family":"Liao","affiliation":""},{"name":"Yichen Wan","slug":"yichen-wan","given":"Yichen","family":"Wan","affiliation":""},{"name":"Shuchen Wu","slug":"shuchen-wu","given":"Shuchen","family":"Wu","affiliation":""},{"name":"Chenxi Miao","slug":"chenxi-miao","given":"Chenxi","family":"Miao","affiliation":""},{"name":"Xin Shen","slug":"xin-shen","given":"Xin","family":"Shen","affiliation":""},{"name":"Weikang Li","slug":"weikang-li","given":"Weikang","family":"Li","affiliation":""},{"name":"Yang Li","slug":"yang-li","given":"Yang","family":"Li","affiliation":""},{"name":"Deguo Xia","slug":"deguo-xia","given":"Deguo","family":"Xia","affiliation":""},{"name":"Jizhou Huang","slug":"jizhou-huang","given":"Jizhou","family":"Huang","affiliation":""}],"abstract":"LLM-based role-playing has rapidly improved in fidelity, yet stronger adherence to persona constraints commonly increases vulnerability to jailbreak attacks, especially for risky or negative personas.\r\nMost prior work mitigates this issue with training-time solutions (e.g., data curation or alignment-oriented regularization).\r\nHowever, these approaches are costly to maintain as personas and attack strategies evolve, can degrade in-character behavior, and are typically infeasible for frontier closed-weight LLMs.\r\nWe propose a training-free Dual-Cycle Adversarial Self-Evolution framework with two coupled cycles.\r\nA Persona-Targeted Attacker Cycle synthesizes progressively stronger jailbreak prompts, while a Role-Playing Defender Cycle distills observed failures into a hierarchical knowledge base of (i) global safety rules, (ii) persona-grounded constraints, and (iii) safe in-character exemplars.\r\nAt inference time, the Defender retrieves and composes structured knowledge from this hierarchy to guide generation, producing responses that remain faithful to the target persona while satisfying safety constraints.\r\nExtensive experiments across multiple proprietary LLMs show consistent gains over strong baselines on both role fidelity and jailbreak resistance, and robust generalization to unseen personas and attack prompts.","doi":"10.24963/ijcai.2026/24","url":"https://ijcai.org/proceedings/2026/24","pdf":"https://ijcai.org/proceedings/2026/0024.pdf","markdown":"https://ijcai.org/proceedings/2026/24.md","bibtex":"https://ijcai.org/proceedings/2026/bibtex/24","volume":{"slug":"2026","title":"Proceedings of the Thirty-Fifth International Joint Conference on Artificial Intelligence","short_title":"IJCAI 2026","url":"https://ijcai.org/proceedings/2026/","year":2026,"location":"Bremen, Germany","dates":"15-21 August 2026","editors":"Diego Calvanese","isbn":"978-1-956792-09-6","publisher":"International Joint Conferences on Artificial Intelligence Organization","doi_prefix":"10.24963/ijcai.2026"},"section":"Agent-based and Multi-agent Systems","track":"Main Track","number":24,"pages":{"first":208,"last":216},"keywords":["Agent-based and Multi-agent Systems: Multi-agent learning"],"videos":[],"references":[],"license_note":"Copyright International Joint Conferences on Artificial Intelligence."}