Writing study: The Attacker in the Mirror: Breaking Self-Consistency in Safety via Anchored Bipolicy Self-Play

NeurIPS overviewCorpus atlasBy contribution typeVisual galleryRules & templateWriting patternsPaper studies

← NeurIPS 2026 oral writing corpus

Gabriele La Malfa, Emanuele La Malfa, Saar Cohen, Jie Zhang, Michael Luck, Michael Wooldridge, Elizabeth Black · Official NeurIPS 2026 oral record

Observed writing choices, not acceptance rules. This study examines the inspected manuscript version. It does not establish why the paper was accepted or that its presentation choices should be copied unchanged.

Figure, table and section ledger

Editorial contribution type: Training, objectives & optimization (primary).

Layout extraction, not a required paper template. Counts are distinct caption labels; a multi-panel figure counts once. Section spans are estimated from heading positions, including floats and whitespace. Method and limitations.

Canonical PDF

23 physical pages

Before references / appendix

≈ 11.09 page-equivalents

Main figures / tables

3 / 4

Attached appendix figures / tables

0 / 5

Attached appendix span

≈ 8.91 page-equivalents

Before references / appendix: ≈ 48.22%References / intervening material: ≈ 13.04%Attached appendix: ≈ 38.74%Estimated layout envelopes, not text/artwork area. Unresolved appendix boundaries remain within the undivided post-body material.

Source-bound correction: Top-level heading and reference/appendix boundaries checked against source PDF text. Bibliography titles/author initials, numbered contribution/property bullets, diagram steps, equations and TOC entries are not substantive headings. Section spans are page-coordinate estimates, not ink area or prose-only length. This is an author manuscript mirror, not a verified accepted-version template. Source layout uses physical single-column y/page-height, including equation-heavy pages.

Section-by-section lengths and source pages

The title/abstract/front matter precede the first numbered heading. A span ends at the next detected top-level heading, not at the last sentence; end-page whitespace is included. References and statements are listed separately. These are not measurements of text-only or artwork area.

Top-level heading	Starts on PDF page	Estimated span	Share of entire PDF
1 Introduction	1	≈ 1.51 pp.	6.57%
2 Related Work	3	≈ 0.53 pp.	2.3%
3 Nash Equilibria, Model Safety, and Self-Play	3	≈ 2.67 pp.	11.61%
4 Anchored Bipolicy Self-Play	6	≈ 0.75 pp.	3.26%
5 Experiments & Results	7	≈ 3.41 pp.	14.83%
6 Conclusion, Limitations, and Future Work	10	≈ 0.48 pp.	2.09%
Acknowledgments	11	≈ 1 pp.	4.35%
References	12	≈ 3 pp.	13.04%
Appendix	15	≈ 0.03 pp.	0.13%
A More Details on Bound 1: An always-refuse equilibrium	15	≈ 2.48 pp.	10.78%
B Absence of Parameter-Level Coupling	17	≈ 0.49 pp.	2.13%
C Experimental Setup	18	≈ 5.91 pp.	25.7%

All detected figure and table locations

Main text

• Figure 1 · p. 2
• Table 1 · p. 7
• Table 2 · p. 8
• Figure 3 · p. 9
• Table 3 · p. 9
• Figure 2 · p. 9
• Table 4 · p. 10

Attached appendix

• Table 5 · p. 22
• Table 6 · p. 22
• Table 7 · p. 23
• Table 8 · p. 23
• Table 9 · p. 23

Argument and organization

1. Problem and contribution

   Distinguishes convergence of a self-play game from useful safe behavior, then identifies parameter sharing as a separate mechanism that can weaken the intended adversarial pressure.

2. Argument sequence

   Theory explains the failure of the existing formulation before the adapter design; evaluation then separates harmful refusal, benign compliance, general capability, cost and attacker transfer.

3. Evidence and verification

   The main results table reports safety and benign/general capability together, keeping regressions visible. Timing is accompanied by hardware and a qualification that measured step times vary with utilization.

Problem, claim and contribution

Distinguishes convergence of a self-play game from useful safe behavior, then identifies parameter sharing as a separate mechanism that can weaken the intended adversarial pressure.

Introduction and Section 3, pp. 1–5 · Main paper

Argument and section order

Theory explains the failure of the existing formulation before the adapter design; evaluation then separates harmful refusal, benign compliance, general capability, cost and attacker transfer.

Sections 3–5, pp. 3–10 · Main paper

Figures, captions and visual explanation

Figure 1 compares three architectures in aligned panels, keeping attacker/defender colors constant and marking separate adapters above a frozen base in the proposed design. Each panel states its resource or coupling trade-off. Table 4 separates direct-harm refusal from fairness/benign-compliance outcomes and repeats model-scale blocks. Its signed, color-redundant changes retain regressions relative to the base model instead of highlighting only gains; the limitation paragraph acknowledges unstable training and collapse modes.

Figure 1, p. 2 (render inspected); Table 4 and limitations, p. 10 (additional rendered inspection) · Main paper

Tables, comparisons and evidence

The main results table reports safety and benign/general capability together, keeping regressions visible. Timing is accompanied by hardware and a qualification that measured step times vary with utilization.

Tables 1–2, pp. 7–8; Table 4, p. 10 · Main paper

Appendix and reproducibility

Formal coupling arguments and experimental configuration are separated; expanded model-scale tables retain reasoning outcomes instead of only the most favorable safety metric.

Appendices A–C, pp. 15–23 · Main paper

Clarity and writing conventions

Named bounds expose trivial equilibrium cases before method claims. Nevertheless, visual labels suggesting guarantees should be read with the formal game's assumptions, not as universal deployment assurances.

Sections 3.1–3.3, pp. 4–5; Figure 1, p. 2 · Main paper

What to reuse—and what not to infer

Transferable lesson: When changing a training interaction, contrast parameter and gradient paths directly and evaluate utility losses alongside the targeted safety gain.

Boundary: Adapter separation does not by itself prove universal safety or useful equilibrium convergence. The evaluated benchmarks and game assumptions bound the conclusion.

Apply this lesson using the argument and evidence worksheet.

Inspection record and sources

Checked

2026-10-02

Reading status

Writing-focused manuscript scan + selected visuals inspected

Main text

Writing-oriented scan across manuscript framing, section sequence, figure/table captions, selected argument/evaluation prose and conclusion; not exhaustive technical or proof verification. Sections 1–6, pp. 1–10, including game-theoretic diagnosis, role-specific adapters, safety/utility evaluation and limitations. Source is the exact public author version listed below, not a verified accepted/camera-ready revision.

Appendix / supplement

Writing-oriented appendix/documentation scan: Appendices A–C, pp. 15–23: formal derivations, parameter-coupling analysis, setup and detailed results; qualitative red-team examples were treated only as writing evidence, not executed. Source code, data, model outputs and external video assets were not executed or independently validated.

Visually inspected PDF pages

2, 10

This is a writing-focused scan of the manuscript and the stated supplementary scope: framing, organization, visual explanation, evidence presentation and wording. It is not a line-by-line proof audit, reproduction of results or exhaustive scientific review.

• Public author arXiv manuscript 2605.08427v1; not verified identical to the accepted or camera-ready OpenReview revision · 23 pages