The increasing use of large language models (LLMs) in mental healthcare raises safety concerns in high-stakes therapeutic interactions. A key challenge is distinguishing therapeutic empathy from maladaptive validation, where supportive responses may inadvertently reinforce harmful beliefs or behaviors in multi-turn conversations. This risk is largely overlooked by existing red-teaming frameworks, which focus mainly on generic harms or optimization-based attacks. To address this gap, we introduce Personality-based Client Simulation Attack (PCSA), the first red-teaming framework that simulates clients in psychological counseling through coherent, persona-driven client dialogues to expose vulnerabilities in psychological safety alignment. Experiments on seven general and mental health-specialized LLMs show that PCSA substantially outperforms four competitive baselines. Perplexity analysis and human inspection further indicate that PCSA generates more natural and realistic dialogues. Our results reveal that current LLMs remain vulnerable to domain-specific adversarial tactics, providing unauthorized medical advice, reinforcing delusions, and implicitly encouraging risky actions.

翻译：大语言模型（LLMs）在心理健康领域的广泛应用引发了高风险治疗互动中的安全问题。一个关键挑战在于区分治疗性共情与适应性不良的认可——在多轮对话中，支持性回应可能无意强化有害信念或行为。现有红队框架主要关注通用危害或基于优化的攻击，严重忽视了这一风险。为弥补这一空白，我们提出基于人格的来访者模拟攻击（PCSA），这是首个通过连贯、人格驱动的来访者对话模拟心理咨询场景，以暴露心理安全对齐中脆弱性的红队框架。在七个通用及心理健康专用LLM上的实验表明，PCSA显著优于四个竞争基线方法。困惑度分析与人工审查进一步表明，PCSA能生成更自然真实的对话。我们的结果揭示，当前LLM仍易受领域特定对抗策略的影响，包括提供未经授权的医疗建议、强化妄想，以及隐晦鼓励危险行为。