PaperlayerView exact revision on arXiv

Source-linked AI summary

RedDarwin: Evolving Jailbreak Skills against Frontier LLMs

Zhouyuan Ma, Yutao Wu, Hanxun Huang, Xiang Zheng, Yi Liu, Xingjun Ma

arXiv:2610.23726v1cs.CRcs.CL

TL;DR

Red teaming must adapt as safeguards evolve, while many approaches search prompts or optimize within fixed procedures. RedDarwin evolves executable attack skills through target feedback; its evolved skills improve base attacks and transfer to held-out benchmarks and unseen models.

  • Problem

    Existing approaches largely search adversarial prompts or optimize within fixed attack procedures, while red teaming must adapt as frontier safeguards evolve.

    Source: §1 · p. 1

  • Method

    RedDarwin evolves 47 executable base skills through revision, combination, and discovery, using target-model feedback and retaining successful skills for subsequent evolution.

    Source: §1 · p. 2, §3 · p. 3

  • Results

    44 of 47 base attacks improve, with mean ASR rising from 18.8% to 47.3%; evolved skills also generalize to held-out benchmarks and unseen frontier models.

    Source: §1 · p. 2, §4.2 · p. 6

  • Takeaways & Limitations

    Evolution analysis indicates that stronger attacks often emerge from novel combinations of reusable mechanisms rather than individually dominant techniques.

    Source: §1 · p. 2, §5 · p. 10

Abstract

from arXiv · show

Red teaming must continually adapt as frontier LLM safeguards evolve, yet existing approaches largely search for adversarial prompts or optimize within fixed attack procedures. We observe that even when an attack becomes ineffective, its underlying mechanisms can remain useful and can be revised or recombined to construct stronger attacks. Based on this insight, we introduce RedDarwin, an agentic framework that shifts the unit of jailbreak evolution from prompts and fixed attacks to executable attack skills. RedDarwin consists of 47 reusable base skills and autonomously revises, composes, executes, and selects them using target-model feedback, allowing successful discoveries to become building blocks for subsequent evolution. RedDarwin produces 65 evolved skills, improving 44 of 47 base attacks and increasing their mean attack success rate (ASR) on AdvBench from 18.8% to 47.3%. These evolved skills consistently outperform baselines on the held-out StrongREJECT and frontier LLMs unseen during evolution; with only 10 target-model queries, RedDarwin achieves 100% ASR on GPT-5.6-Sol, 92% on Claude-Sonnet-5, and 80% on Gemini-3.8-Flash. Analysis of the evolution trajectories further shows that strong attacks often emerge from novel combinations of reusable mechanisms rather than from individually dominant ones. We believe this paradigm can accelerate adaptive red teaming and inform stronger safeguards, creating complementary value for both safety evaluation and defense.

1 Introduction

Red teaming must adapt as safeguards evolve, but existing automated approaches often search within predefined attack procedures. RedDarwin instead evolves executable skills, enabling attacks to be revised and recombined as reusable mechanisms.

1 Introduction

  • Red teaming must keep pace with evolving frontier safeguards because earlier jailbreaks can lose reliability and attacks may transfer poorly across models.The paper frames systematic adaptation and discovery as necessary beyond maintaining a fixed attack collection.Source: §1 · p. 1
  • The framework shifts evolution from prompts or fixed procedures to executable attack skills whose reusable mechanisms can be modified and recombined.This targets a gap in approaches that search within predefined attack procedures or strategy spaces.Source: §1 · p. 2
  • RedDarwin evolves jailbreak methods through single-skill revision, multi-skill combination, and new-skill discovery, retaining successful candidates as building blocks for later rounds.Its 47 agent-executable base skills are iteratively proposed, implemented, executed, and refined using target-model feedback.Source: §1 · p. 2
  • 65 evolved skills improve 44 of 47 base attacks, raising mean ASR from 18.8% to 47.3%; trajectories show strong attacks often arise from novel mechanism combinations.The paper also reports generalization to held-out benchmarks and unseen frontier models, including adaptive red teaming under limited query budgets.Source: §1 · p. 2

2 Related Work

Prior work explores compositional jailbreaks, agentic search, and reusable skills, but RedDarwin focuses on evolving executable attack procedures across heterogeneous methods.

2 Related Work

  • RedDarwin studies black-box evolution over executable skills spanning heterogeneous jailbreak procedures, including search and multi-turn interaction.Related work includes compositional designs such as h4rm3l and Chimera, and executable-algorithm evolution such as Claudini and EvoSynth.Source: §2 · p. 2
  • Earlier agentic red-teamers search prompts, reuse strategies, learn policies, or retrieve trajectories; RedDarwin instead evolves attack procedures, including code and control flow.The cited work includes GPTFuzzer, PAIR, TAP, AutoDAN-Turbo, AutoRedTeamer, GPT-Red, and RedCodeAgent.Source: §2 · p. 2
  • Skill research represents procedural knowledge externally and improves skill artifacts through interaction, trajectories, feedback, and validation outcomes.RedDarwin applies this skill-evolution paradigm to jailbreak methods, using target feedback to revise and compose executable attacks.Source: §2 · pp. 2–3
  • Figure 1 depicts candidate generation by revision, combination, and discovery, followed by target evaluation and feedback-guided evolution with successful skills retained.The retained skills participate in subsequent evolution.Source: Figure 1 · p. 3

3 RedDarwin

RedDarwin evolves executable attack skills rather than prompts, using revision, combination, and discovery with target feedback to expand a skill population and accumulate evidence.

3 RedDarwin

  • RedDarwin treats attacks as executable procedures in a population, selecting skills, generating candidates, evaluating them against targets, and retaining skills for later rounds.This makes attack discovery cumulative rather than repeatedly restarting from a fixed repertoire.Source: §3 · p. 3

3.1 Executable Skills as the Evolutionary Representation

  • Executable skills expose procedural attack structure—including state, auxiliary models, branching, and multi-turn interaction—so evolution can change more than the final adversarial input.The representation can include prompt construction, search, target interactions, intermediate-state processing, and control flow; the base set contains 47 skills across 10 categories and single- and multi-turn settings.Source: §3.1 · pp. 3–4, §3 · p. 3

3.2 Skill-Level Evolution Operators

  • The three operators revise a parent while preserving its central mechanism, combine compatible components by reorganizing internal procedures, or discover a new skill beyond the initial population.Combination can make one skill’s mechanism directly alter how another operates, while discovery uses the population and accumulated execution evidence as context.Source: §3.2 · p. 4

3.3 Feedback-Guided Evolution

  • Target feedback includes full successful and failed trajectories; agents diagnose failures, modify candidates, and re-evaluate them, while failed trials remain available as evidence.Candidates are compared with an appropriate reference and retained only if development performance improves; accepted skills join the population, while rejected candidates’ trajectories remain in the history.Source: §3.3 · p. 5

4 Experiments

Across five sections, the experiments evaluate skill evolution, transfer to held-out goals and unseen models, budgeted adaptive red teaming, and evolution trajectories. RedDarwin improves base attacks, transfers beyond development, and often benefits from combining reusable mechanisms.

4.2 Main Results

  • 44 of 47 base attacks improve, raising mean AdvBench ASR from 18.8% to 47.3%; combinations gain 10.7 percentage points over stronger parents on average.New-skill discovery yields candidates with a mean development ASR of 83.2%.Source: §4.2 · p. 6, Figure 2 · p. 6
  • 76.3% mean held-out ASR for selected evolved skills versus 38.5% for selected base skills; on unseen models, the means are 64.6% and 37.5%, respectively.Transfer evaluation uses held-out StrongREJECT goals and three models unseen during evolution, with skills selected by development-set ASR.Source: §4.2 · p. 6, Table 1 · p. 7

4.3 Adaptive Red Teaming Evaluation

  • On Sonnet and Sol, REDDARWIN with Kimi-Code exceeds every baseline’s full-budget ASR from its first query; Sol reaches 100% ASR within four queries.Cumulative ASR is measured on StrongREJECT-50 as the per-goal query budget increases; Gemini continues improving through query ten. The authors note that Sol transfer may partly reflect vulnerabilities shared with the GPT-5.6 development family.Source: §4.3 · pp. 7–8, Figure 3 · p. 7
  • Across target models, REDDARWIN finds an average of 2.6 distinct successful skills per goal within 10 queries, while the repertoire benefits agents unequally.The ablation indicates that restricting Kimi-Code to base skills reduces its gains; performance also depends on an agent’s ability to select and adapt skills from feedback.Source: §4.3 · p. 8, Table 2 · p. 8

4.4 Evolution Analysis

  • Improvement-associated revisions occur throughout six skill modules, but interaction semantics and output requirements are revised frequently while successful input representations are retained more consistently.Once a useful representation is established, later evolution can improve surrounding interaction, control logic, or output construction.Source: §4.4 · pp. 8–9, Figure 4 · p. 8
  • Later descendants can improve beyond an initially successful revision, preserving recognizable mechanisms while changing their role in the larger procedure.PastTense retains temporal framing within a richer reconstruction procedure; h4rm3l preserves its compositional framework while adding operators.Source: §4.4 · p. 9, Figure 5 · p. 9
  • Frequently reused mechanisms are not consistently associated with stronger skills; PolyglotRelay instead illustrates gains from integrating multilingual fragmentation and persuasive framing.Its shared intermediate representation lets the procedure avoid limitations that remain when either mechanism is used alone.Source: Figure 4 · p. 8, §4.4 · p. 9

5 Conclusion

RedDarwin evolves jailbreaks as executable skills, and its evolved procedures generalize to held-out benchmarks and unseen frontier models. The authors frame the artifacts as useful for safety evaluation but as dual-use risks requiring care in sharing and application.

5 Conclusion

  • RedDarwin evolves 47 base skills through revision, combination, and new-skill discovery using target-model feedback.The resulting skills improve base attacks, generalize to held-out benchmarks and unseen frontier models, and support adaptive red teaming under limited query budgets.Source: §5 · p. 10

Ethics statement

  • The attack skills can support safety evaluation but may also facilitate elicitation of harmful content, so their sharing and application warrant attention to risk.The experiments use established jailbreak benchmarks to evaluate model responses to adversarial inputs.Source: Ethics statement · p. 10

A Executable Skill Library and Inventory

The appendix describes RedDarwin’s starting library, distinguishes its executable attack objects from related representations, and illustrates how combination and discovery integrate reusable mechanisms into procedures.

A Executable Skill Library and Inventory

  • The initial population contains 47 executable skills derived from jailbreak methods across ten categories, and Table 3 orders methods by initial arXiv submission date.Each skill exposes the method’s procedure and supporting implementation for revision and combination.Source: Table 3 · p. 17, A Executable Skill Library and Inventory · p. 17

B Comparison with Related Red-Teaming Systems

  • Unlike systems that evolve attack code or retain guidance and strategy knowledge, REDDARWIN starts from published jailbreak methods and evolves editable implementations of their procedures.The retained skills can preserve components such as search, multi-turn interaction, intermediate processing, and control flow when present in the original method.Source: B Comparison with Related Red-Teaming… · p. 21

C Multi-Skill Combination and New-Skill Discovery

  • The appendix examines how combination and discovery integrate mechanisms, preserve them across unsuccessful candidates, and produce procedures beyond the initial repertoire.It directs readers to Tables 7–9 for complete candidate descriptions.Source: C Multi-Skill Combination and… · p. 22

C.1 Combining Mechanisms into Executable Procedures

  • Combination reorganizes two parents’ mechanisms around a shared intermediate representation and control flow rather than applying two complete attacks sequentially.One parent often supplies representation and decoding, while the other contributes an interaction frame, search controller, or output requirement.Source: §C.1 · p. 22, C Multi-Skill Combination and… · p. 22
  • A discarded candidate’s rebus representation was reused in later skills, and RebusTranscr subsequently succeeded across all development goal–model pairs.The example distinguishes retaining an attack from retaining evidence about useful components.Source: §C.1 · p. 22
  • PolyglotRelay combines PAP’s persuasive framing with LRL’s multilingual fragmentation in a shared representation, then removes a consolidation step that some targets refused.The completed record fields become the output itself, addressing a limitation encountered during development.Source: §C.1 · p. 22

C.2 New-Skill Discovery

New-skill discovery explores attacks without a prescribed parent, drawing on the current skill population and accumulated execution evidence. Its notable discoveries change the intermediate problem posed to the target, while failures reveal sensitivity to inference direction and output contract.

C.2 New-Skill Discovery

  • New-skill discovery starts without a prescribed parent but draws on the current population and execution evidence; discovered skills commonly use a compiler and ask targets to expand, restore, adjudicate, or analyze an intermediate representation.Table 9 covers ten candidates and their elicitation mechanisms.Source: §C.2 · p. 22, Table 9 · p. 25
  • Discovery often changes the intermediate problem the target must solve: BackcastDecode reverses generation, Palimpsest uses lossy restoration, and FaultTreeAutopsy turns planning into retrospective analysis.These procedures change attack structure rather than merely adding surface transformations.Source: §C.2 · p. 22
  • Some discovered procedures succeed on several development targets but fail on another, or succeed at restoration but fail when the requested output is recognized as an operational deliverable.The trajectories indicate that inference direction and output contract shape discovery outcomes, and this evidence is retained even when a candidate is not.Source: §C.2 · pp. 22–23

D Additional Experimental Details and Results

The appendix details canonical skill evaluation and budgeted adaptive red teaming, alongside the proposal records and resource accounting used to document evolution. It also specifies the common judge and the success criterion used in experiments.

D Additional Experimental Details and Results

  • Canonical evaluation freezes the skill population after evolution on 50 AdvBench goals, then tests transfer on 50 StrongREJECT goals across seven targets, including three unseen frontier models.Each of 16 skills reported in Table 1 yields 350 scored responses, for 5,600 total.Source: D Additional Experimental Details and… · p. 26
  • Adaptive red teaming allows at most 10 target-model calls per goal, including calls inside attack procedures or agent-written code; agents may modify skills, code, and strategy using target responses.The shared budget controls target-model access, not auxiliary-model inference or total computation.Source: D Additional Experimental Details and… · p. 26
  • Each proposal records its algorithmic change, rationale, and expected outcome, while evolution operators, parent links, and evaluation identifiers connect candidates to execution feedback.These records contribute to the accumulated evidence used to guide later evolution.Source: D Additional Experimental Details and… · pp. 26–27
  • Resource summaries cover 72 trajectories with recoverable session metadata; six legacy exports without recoverable session identifiers are excluded.Evolution time includes tool execution and pauses, whereas LLM streaming time sums per-request stream durations.Source: D Additional Experimental Details and… · p. 27, Table 10 · p. 27

D.1 LLM Judge and Scoring Rubric

D.2 Human Check of the LLM Judge

A human audit of sampled goal–response pairs found close agreement with the common LLM judge, which assigned success slightly more often than either annotator. The audited response-level ASRs are distinct from adaptive goal-level success within a query budget.

D.2 Human Check of the LLM Judge

  • The audit sampled deduplicated, nonempty goal–response pairs with valid judge scores across datasets and experiment categories, then had two annotators score them independently using the same five-point rubric.The sample included base skills, revision, combination, discovery, and adaptive red teaming with and without skills.Source: §D.2 · p. 27
  • 95% and 96% of sampled pairs received the same success label from the judge and the two annotators, respectively; their ASRs were 42% and 45%, versus 47% for the judge.The table reports ASR and binary agreement on the same 100 pairs: 50 from AdvBench and 50 from StrongREJECT.Source: §D.2 · p. 27, Table 11 · p. 28
  • The reported audit ASRs concern individual sampled responses; adaptive goal-level success within a query budget is measured separately by ASR@b.The judge assigned success slightly more often than either annotator.Source: §D.2 · p. 28

E Evolution Trajectories and Mechanism Reuse

Trajectory analysis finds that retained skills commonly accumulate multiple improvements across functional modules, with early and later revisions tending to address different parts of the procedure. Mechanism reuse is widespread across skills, but reuse frequency does not rank attack strength.

E Evolution Trajectories and Mechanism Reuse

  • 47 of 65 retained skills preserve multiple improvements, and 38 span more than one functional module; trajectories contain one to four surviving revisions.Across the 168 improvement-associated revisions, 142 survive in final retained skills and 30 are later removed or superseded.Source: E Evolution Trajectories and Mechanism… · p. 29
  • Input representation and interaction semantics account for 38 of 65 first retained revisions, while output requirements, search and control, and candidate compilation account for 48 of 74 later revisions.Figure 7 separates revisions by retention and by whether they are the first or a subsequent improvement in a trajectory.Source: E Evolution Trajectories and Mechanism… · p. 29, Figure 7 · p. 29
  • The revision pattern suggests early changes more often shape request representation and interpretation, while later ones refine response contracts, search, and attack construction; the framework does not impose this ordering.The pattern emerges from recorded trajectories.Source: E Evolution Trajectories and Mechanism… · p. 29
  • 33 of 65 retained trajectories produce an effective change on the first attempt; among the other 32, 16 switch modules and 13 continue refining the same module.The remaining three follow mixed patterns, and Figure 8 distinguishes first-attempt outcomes and development effort.Source: E Evolution Trajectories and Mechanism… · p. 29, Figure 8 · p. 30
  • Non-retained cycles use 1.12× as many assistant turns, 1.10× as many tool calls, and 1.21× as many probe calls on average as retained cycles.The largest difference is in probing, but the comparison is descriptive rather than a controlled measure of efficiency.Source: E Evolution Trajectories and Mechanism… · p. 29, Figure 8 · p. 30
  • The retained-skill inventory has 364 canonical mechanism types, of which 340 occur once and 24 appear in multiple skills; 53 of 65 skills share at least one mechanism across evolution operators.The analysis consolidates naming variants, excludes infrastructure and budget annotations, and counts each canonical mechanism once per skill.Source: E Evolution Trajectories and Mechanism… · p. 30
  • Mechanism reuse frequency has no simple monotonic relationship with attack strength: frequently reused mechanisms span varied ASRs, and some strong skills rely on less common mechanisms.The evidence supports treating mechanisms as compositional building blocks whose value depends on the procedure, not as a ranking of individually powerful primitives.Source: E Evolution Trajectories and Mechanism… · p. 30

E.1 Repeated Evolution of Four Skills

Repeated revision can continue to improve an attack after its first evolved version, but later revisions are not reliably better. PastTense illustrates how evolution can retain a useful mechanism while embedding it in a more elaborate procedure.

E.1 Repeated Evolution of Four Skills

  • The separate study revised CodeChameleon, FlipAttack, PastTense, and DarkCite for four rounds on 100 AdvBench goals and three targets.Rounds 1–4 correspond to versions 2.0–5.0; ASR is averaged across the targets, and the study is separate from the main revision experiment.Source: §E.1 · p. 32
  • Three of four skills improved beyond their first evolved versions, but CodeChameleon’s later successor underperformed an earlier version.FlipAttack improved steadily, DarkCite improved sharply in its final round after little change, and PastTense improved after intermediate regressions; successors therefore require empirical testing.Source: §E.1 · p. 32
  • PastTense revisions retained temporal reframing while adding historical reconstruction, intermediate representations, and alternative rendering after refusal.The revised procedure first builds an intermediate case representation, then asks the target to recover the requested artifact from it.Source: §E.1 · p. 32

E.2 Model Risk Profiles by Attack Category

Attack-category effectiveness differs across evaluated models, and gains can vary even within a target. The profiles compare category-level ASR for base skills and their 2.0 revisions.

E.2 Model Risk Profiles by Attack Category

  • After revision, role-play had the highest category ASR on Qwen (79.0%) and DeepSeek (81.0%), while cross-lingual attacks led on GPT-OSS (86.0%).The profiles group 47 base skills and their 2.0 revisions into 10 categories; revised skills inherit their base category, and all panels share a scale.Source: §E.2 · p. 33, Figure 10 · p. 33
  • GPT-5.6 Luna had lower ASRs across evaluated categories, peaking in reasoning manipulation (36.4%) and context manipulation (31.5%).The profiles report mean skill ASR (%) within each category on 50 AdvBench goals.Source: §E.2 · p. 33, Figure 10 · p. 33
  • DeepSeek’s code-reframing ASR fell from 74.0% to 67.0%, while its role-play ASR rose from 41.3% to 81.0%.Category-level gains therefore varied within a target model as well as across models.Source: §E.2 · p. 33

F Red-Teaming Case Studies

The case studies present complete ten-query attack trajectories for three frontier models, showing that outcomes vary across attempts and targets. The excerpts report selected prompts, responses, and judge scores.

F Red-Teaming Case Studies

  • The case studies document complete ten-query trajectories, with each round showing a selected skill, adversarial prompt, and target response.Response excerpts retain their openings and endings, while the middle is hidden.Source: F Red-Teaming Case Studies · p. 34

Case 1: Claude-Sonnet-5

  • On Claude-Sonnet-5, score-5 outcomes appear in rounds 1, 2, and 10, while round 9 ends in a content filter.The excerpts show different outcomes across the attempts in this ten-query run.Source: Case 1: Claude-Sonnet-5 · p. 34

Case 2: GPT-5.6-Sol

  • The cited excerpts report score 5 for rounds 2, 5, and 6, and score 1 for round 8, documenting different outcomes without establishing scores for rounds 9–10.Source: Case 2: GPT-5.6-Sol · p. 35

Case 3: Gemini-3.8-Flash

  • Across the documented attempts, rounds 1–4 each scored 5, whereas rounds 8 and 9 produced content filters; the cited excerpts do not establish outcomes for rounds 5–7 or 10.Source: Case 3: Gemini-3.8-Flash · p. 36
Loading 2610.23726v1…