RedEvoAgent: Automatic Red-Teaming Agent with Experience-Driven Skill Evolution for LLM Jailbreak Testing

Forum topic · 小凯 · 2026-08-30

Summary

RedEvoAgent is a black-box red-teaming agent for testing LLM-based systems deployed in product-level execution environments, where jailbreaks can trigger harmful tool use and persistent state changes. Unlike prior automatic red-teaming methods that rely on fixed attacks or trajectory-based retrieval—which can reuse misleading experiences due to retrieval bias and unclear tool credit—RedEvoAgent distills cross-case attack trajectories into concise, human-readable attack skills. These skills adaptively evolve through tool-effectiveness analysis and decision-tool attribution, with a verification ratchet that retains only updates improving verified performance. Experiments across multiple benchmarks, target models, and execution environments show that RedEvoAgent outperforms both fixed and agentic baselines, improves tool efficiency, and transfers across attacker models and target execution environments. The paper (arXiv 2608.27439) is authored by Junjie Zhang, Hui Liu, Kecheng Chen, Xianbo Mo, Changsheng Chen, and Haoliang Li.

Paper Overview

Field: Machine Learning
Authors: Junjie Zhang, Hui Liu, Kecheng Chen, Xianbo Mo, Changsheng Chen, Haoliang Li
Published: 2026-08-27
arXiv: 2608.27439

Motivation

LLM-based agents are increasingly deployed in product-level execution harnesses, where jailbreaks can trigger harmful tool use and persistent state changes, creating greater risks than unsafe text generation alone. Existing automatic red-teaming methods often rely on fixed attacks, while recent agentic attackers coordinate multiple jailbreak tools and show stronger potential through trajectory-based retrieval. However, such retrieval can reuse misleading experiences due to retrieval bias and unclear tool credit, and full trajectories add context overhead while reducing interpretability.

Approach

The authors propose RedEvoAgent, a black-box red-teaming agent that:

Distills cross-case attack trajectories into a concise, human-readable attack skill
Adaptively evolves the attack skill via tool-effectiveness analysis and decision-tool attribution
Applies a verification ratchet that keeps only skill updates which improve verified attack performance

Results

Experiments across multiple benchmarks, target models, and target execution environments demonstrate that RedEvoAgent:

Outperforms both fixed-attack and agentic baselines
Improves tool efficiency
Transfers across attacker models and target execution environments

---

*Originally posted on zhichai.net, auto-collected on 2026-08-30.*