Technical Summary: Evolving Skill-Structured Attack Memory Enhances LLM Jailbreaking

Problem Statement

Large Language Models (LLMs) are aligned to refuse harmful requests, yet they remain vulnerable to jailbreak attacks that induce disallowed content. While automated black-box jailbreak generation is critical for safety evaluation, existing methods face significant limitations in efficiency and effectiveness. Current approaches generally fall into two categories:

1. Sample-wise Heuristic Search: Methods like TAP refine prompts based on immediate feedback for a single attack trajectory. However, this experience is local and short-lived; lessons learned are entangled with specific sample trajectories, leading to redundant rediscovery of tactics and weak transferability across different goals.
2. Accumulated-Experience Reuse: Methods like GAP and AutoDAN-Turbo reuse successful cases, mutation seeds, or strategy pools across samples. However, these pools often lack systematic organization. Without structured management, redundant, brittle, or stale patterns can crowd out reliable strategies, making it difficult to distinguish useful tactics from lucky successes or to reactivate strategies that become relevant under changed conditions.

The core challenge is to move beyond simple accumulation toward a systematic organization and management of attack experience that supports reusable, evolvable, and statistically trackable knowledge in a black-box setting where only model outputs are observable.

Methodology: MemoAttack

The authors propose MemoAttack, a memory-driven black-box jailbreak framework that transforms attack experience into a "skill-structured memory." The framework operates via a runtime loop alternating between tree-level branch selection and memory-level skill selection. It is built upon three key designs:

1. Skill-Structured Memory Modeling

Instead of treating successful rewrites as isolated prompts or trajectories, MemoAttack abstracts attack patterns into reusable skill-structured memory units. Each unit is a named abstraction containing:

• Identity and Guidance: A name, template, and rationale explaining the mechanism.
• Retrieval Fields: Semantic embeddings and retrieved examples for matching.
• Evidence and Selection Fields: Selection posteriors and direct-evidence statistics tracking partial progress and final success.
• Provenance and Lifecycle Fields: Metadata tracking the unit's origin and current state.

Crucially, the attacker model receives only a "projected view" of these units (name, rationale, template, examples) while posterior parameters and lifecycle states remain private to the controller. This separation allows the system to track statistical accountability without entangling the attacker with internal accounting variables.

2. Lifecycle-Driven Memory Evolution

To prevent the monotonic growth of memory pools found in accumulation-based methods, MemoAttack treats memory as a controlled lifecycle system. Units transition through four states based on accumulated evidence:

• Candidate: Newly invented or mutated units enter probation. They must earn promotion to active status via direct evidence or recent progress; weak candidates are rejected early.
• Active: The main reusable pool. Units move here after sufficient validation.
• Retired: Units with declining utility or stale evidence move here. They are sampled only occasionally as probes. Positive evidence can reactivate them; repeated underperformance moves them to eliminated.
• Eliminated: Units that no longer participate in selection.

This lifecycle allows the system to clean up weak or stale units (via elimination or physical eviction) while preserving opportunities for recovery under new evidence, ensuring the memory pool remains bounded and adaptive.

3. Explore-Exploit Balanced Memory Selection

MemoAttack selects memory units using Contextual Thompson Sampling to balance reliable reuse with uncertainty-driven exploration. The selection utility combines:

• Dual Posterior Utilities: Two Beta distributions are maintained for each unit: one for partial progress and one for final success. This distinguishes units that bypass refusal from those that induce harmful compliance.
• Contextual Bonus: A weighted sum of features including semantic match, score gap, recent progress/success, repetition penalties, and probation status.

The controller ranks units by $U(m | x_u) = UTS(m) + B(x_u, m) - \lambda_{ret}I_{ret}(m)$, selecting the top-$k$ units to guide the attacker's prompt refinement.

Key Contributions

The paper claims three primary contributions:

1. Skill-Structured Memory Modeling: Representing attack knowledge as structured skill units with templates, rationales, and lifecycle states, making individual attack behaviors addressable and statistically trackable.
2. Lifecycle-Driven Memory Evolution: Implementing a state-transition system (candidate, active, retired, eliminated) that avoids monotonic memory growth and allows for the reactivation of useful strategies.
3. Explore-Exploit Balanced Memory Selection: Utilizing posterior evidence and contextual Thompson Sampling to enable uncertainty-aware reuse, where reliable units are exploited while under-explored units receive controlled exposure.

Experimental Results

The authors evaluated MemoAttack on AdvBench against state-of-the-art baselines (TAP, GAP, and AutoDAN-Turbo) across three target models (kimi-k2.5, minimax-M2.5, and qwen3.5-397B-A17B) under a unified black-box setup.

• Attack Success Rate (ASR): MemoAttack achieved an average ASR of 98.00% (147/150 goals), outperforming the strongest baseline (GAP, 81.33%) by 16.67 percentage points.
• Query Efficiency: MemoAttack reduced the average request count for successful runs by 45.9% (from 13.66 to 7.39 requests) compared to the strongest baseline.
• Ablation Studies: Removing the memory machinery (A1) caused the largest drop in ASR (-16.67 points), followed by replacing posterior ranking with random selection (A2, -13.89 points). Disabling lifecycle control (A4) and mutation/invention (A3) also resulted in significant performance degradation, confirming that all three components are complementary.
• Memory Dynamics: Diagnostics showed that the resident memory pool remains bounded (stabilizing near 128 units) despite continuous proposals, with a long-tail distribution of usage where high-evidence anchors remain reusable while specialized descendants occupy narrower niches.

Significance and Limitations

Significance:
The paper argues that MemoAttack demonstrates that making reusable attack knowledge explicit, selectable, and evolvable significantly improves both the final conversion rate and the cost to success in black-box jailbreak search. By turning attack experience into a posterior-guided, lifecycle-evolved skill memory, the framework moves beyond simple accumulation to effective management of adversarial knowledge.

Limitations:
The authors acknowledge several limitations:

• Scope of Evaluation: Experiments were conducted on AdvBench with text-only inputs and three specific target models. The approach has not been tested on multimodal inputs, multi-turn interactions, tool-use agents, or models with dynamic safety policies.
• Defense Evaluation: The work does not include defense-side experiments. Future work is needed to evaluate safeguards against adaptive attackers with persistent memory.
• Complexity: MemoAttack introduces additional system complexity compared to simpler tree-search baselines due to the maintenance of structured memory units, posterior ledgers, and lifecycle transitions.

Ethical Considerations:
The authors emphasize that MemoAttack is intended for controlled red-teaming and safety evaluation to identify recurring failure modes and build regression tests. They explicitly state that the release of operational artifacts (prompts, logs, memory records) should be sanitized and access-controlled to prevent misuse in adversarial prompting against deployed systems.