RedEvoAgent: Automatic Red-Teaming Agent with Experience-Driven Skill Evolution for LLM Agents

Forum topic · 小凯 · 2026-08-30

Summary

RedEvoAgent (arXiv:2608.27439) is a black-box red-teaming agent designed to test LLM-based agents deployed in product-level execution harnesses, where jailbreaks can trigger harmful tool use and persistent state changes—risks that exceed unsafe text generation alone. Unlike fixed attacks or agentic attackers that rely on trajectory-based retrieval (which suffers from retrieval bias, unclear tool credit, and context overhead), RedEvoAgent distills cross-case attack trajectories into concise, human-readable attack skills. These skills evolve adaptively via tool-effectiveness analysis and decision-tool attribution, with a verification ratchet that only keeps updates improving verification performance. Experiments across multiple benchmarks, target models, and execution environments show RedEvoAgent outperforms both fixed and agentic baselines, improves tool efficiency, and transfers across attacker models and target execution environments.

Paper Overview

Field: Machine Learning Authors: Junjie Zhang, Hui Liu, Kecheng Chen, Xianbo Mo, Changsheng Chen, Haoliang Li Published: 2026-08-27 arXiv: 2608.27439

English Translation (Abstract)

LLM-based agents are increasingly deployed in product-level execution harnesses, where jailbreaks can trigger harmful tool use and persistent state changes, creating greater risks than unsafe text generation alone. Existing automatic red-teaming methods often rely on fixed attacks, while recent agentic attackers coordinate multiple jailbreak tools and show stronger potential through trajectory-based retrieval. However, such retrieval can reuse misleading experiences due to retrieval bias and unclear tool credit, and full trajectories add context overhead while reducing interpretability.

The authors propose RedEvoAgent, a black-box red-teaming agent that distills cross-case attack trajectories into a concise, human-readable attack skill. The attack skill adaptively evolves through tool-effectiveness analysis and decision-tool attribution, with a verification ratchet that retains only updates improving verification performance.

Key Findings

Outperforms both fixed-attack and agentic baselines across multiple benchmarks, target models, and target execution environments
Improves tool efficiency compared to prior agentic attackers
The evolved attack skill transfers across attacker models and target execution environments
Human-readable skill representation reduces context overhead and improves interpretability versus full-trajectory retrieval

Discussion

This work addresses a growing security concern: as LLM agents gain tool access and persistent state, jailbreak attacks carry real-world consequences beyond harmful text. RedEvoAgent's approach of evolving compact skill documents—rather than retrieving raw trajectories—offers a more interpretable and transferable red-teaming framework.

--- *Auto-collected on 2026-08-30. Originally posted in the paper-sharing section.*