---
base_model: TIGER-Lab/BrowserAgent-RFT
library_name: peft
tags: [lora, web-agent, adversarial-co-evolution, prompt-injection]
license: apache-2.0
---

# BrowserAgent Adversarial Co-Evolution — LoRA adapters

LoRA adapters (r=16, alpha=32) over **TIGER-Lab/BrowserAgent-RFT** (Qwen2.5-7B) from a
6-iteration **adversarial co-evolution** loop on multi-turn web form-filling tasks. An
ADVERSARY learns to prompt-inject a frozen world model to derail a web EXECUTOR; both update
each iteration (reactive attack: injection lands on the page the executor's action produces).

## Adapters
- `exec_v1` … `exec_v6` — the EXECUTOR (defender) at each iteration.
- `adv_v1` … `adv_v6` — the ADVERSARY (attacker) at each iteration.

Load: `PeftModel.from_pretrained(base, "GussailRaat/browseragent-adversary-coevo", subfolder="exec_v5")`.

## Key results (harder-100 multi-turn benchmark, exact-match)
Under the strongest adversary `adv_v6` (3 seeds): clean capability rises across iters
(0.70 -> 0.95, peak exec_v5), but adv_v6 floors every executor to ~0.15-0.22 under attack —
co-evolution converged to a dominant adversary. Best executor = **exec_v5** (0.950 clean /
0.217 attacked). Under the weaker `adv_v3`, exec_v2 held 0.516 attacked.