Search papers, labs, and topics across Lattice.
This paper introduces a self-evolving defense framework against jailbreak attacks on large language models (LLMs), which traditionally suffer from static defenses that fail to adapt to new attack strategies. By utilizing a persistent, cross-interaction rule memory, the framework abstracts successful attack patterns into method-level rules that generalize across attack families, allowing for dynamic adaptation without requiring parameter updates. Experimental results demonstrate that this approach significantly reduces attack success rates across multiple models and attack families while maintaining benign output quality and robustness against adaptive attacks.
Attack success rates plummet as this self-evolving defense framework learns from each jailbreak attempt, adapting in real-time without any parameter tuning.
Large language models (LLMs) remain vulnerable to jailbreak attacks that exploit techniques such as role-playing, obfuscation, code transformation, and multi-step indirection to elicit harmful outputs. As jailbreak strategies keep emerging, defenses have proliferated in an ongoing cat-and-mouse game, yet most remain static: their safety behavior is fixed at deployment, so they cannot accumulate defensive experience or adapt to unseen strategies. We propose a self-evolving test-time defense built around a persistent, cross-interaction rule memory: when an attack succeeds, the framework abstracts that failure into a method-level rule capturing the structural attack wrapper rather than the harmful topic, and reuses it against future inputs. Because rules are method-level, one induced rule generalizes across an entire attack family, and the label space expands as novel wrappers appear. The mechanism operates entirely through external memory and prompting, with no parameter updates, and applies to both open-weight and black-box API models. We realize it as four cooperating modules, but the contribution is the memory-based adaptation mechanism, not the module decomposition. Across four black-box jailbreak families and multiple models, our method substantially reduces attack success rates while preserving benign utility, remains robust under an adaptive composite-wrapper attack, and does not increase over-refusal as the memory grows.
