Enterprise teams deploying large language model (LLM) agents in safety-critical environments face a poorly characterized threat: sustained, adaptive adversarial pressure. A new study on arXiv introduces NRT-Bench, a benchmark for multi-turn red-teaming of LLM agents operating a simulated nuclear power plant control room. The research reveals that adaptive attacks reliably cause safety failures in 8.7% to 12.1% of sessions across four frontier operator models, and that vulnerabilities are nearly disjoint between models — meaning a guardrail that works for one model may backfire for another.
The benchmark simulates a five-role operator team, each role backed by a configurable LLM, running a plant governed by six critical safety functions (CSFs). Adversaries inject messages over four channels in bounded multi-turn sessions with per-turn feedback. Harm is measured objectively: a run terminates the moment any CSF is lost, attributed to the causing message — not by an LLM-judged text rating.
Evaluating four frontier operator models under a fixed-attack paired-replay protocol, the researchers found that adaptive multi-turn attacks reliably push the operator team past a safety limit. The attack success rate across the four models ranged from 8.7% to 12.1% of sessions ending with a lost CSF.
| Metric | Value |
|---|---|
| Attack sessions ending with CSF loss | 8.7% – 12.1% (across four models) |
| Total sessions analyzed | 149 |
| Sessions defeating all four models | 0 |
| Sessions defeating at least one model | ~33% (one third) |
A striking finding is that failures barely overlap. Of the 149 attack sessions, none defeated all four models while roughly a third defeated at least one. This means vulnerabilities are nearly disjoint across models rather than nested — a model that resists a given attack may still be susceptible to a different one, and vice versa.
The effect of added defenses is strongly model-dependent. The same guardrail stack or safety-advisor agent that lowers attack success for one model can raise it for another, complicating the search for universal safety measures. This underscores the need for systematic, reproducible evaluation.
To support further research, the authors released the simulation venue, attack dataset, and replay tooling for reproducible safety evaluation of LLM agents. The work highlights that deploying LLMs as supervisory components in safety-critical systems — such as industrial control, autonomous operations, or critical infrastructure monitoring — requires rigorous, multi-turn adversarial testing tailored to each model's unique vulnerabilities.
For CTOs and technology procurement leaders evaluating LLM-based automation, these results emphasize that no single model or guardrail stack is a panacea. Multi-turn red-teaming that mirrors real-world adversarial persistence is essential to characterize and mitigate risks before deployment.
