RedEvoAgent: Automatic Red-Teaming Agent with Experience-Driven Skill Evolution
2026-08-27 • Cryptography and Security
Cryptography and SecurityArtificial Intelligence
AI summaryⓘ
The authors address the problem of improving how AI agents test for security weaknesses in other AI systems, especially when these weaknesses can cause harmful tool use or persistent changes. They point out that earlier methods either used fixed attacks or complex, hard-to-interpret multi-step attacks. Their new method, RedEvoAgent, creates simple and understandable attack strategies by learning from previous attacks and only keeping improvements. Experiments show this approach works better and is more efficient than previous ones across different systems.
LLM-based agentsjailbreak attacksred teamingtool-effectiveness profilingtrajectory-based retrievalattack skill distillationblack-box testingAI securityvalidation ratchet
Authors
Junjie Zhang, Hui Liu, Kecheng Chen, Xianbo Mo, Changsheng Chen, Haoliang Li
Abstract
LLM-based agents are increasingly deployed in product-level execution harnesses, where jailbreaks can trigger harmful tool use and persistent state changes, creating greater risks than unsafe text generation alone. Existing automatic red-teaming methods often rely on fixed attacks, while recent agentic attackers coordinate multiple jailbreak tools and show stronger potential through trajectory-based retrieval. However, such retrieval can reuse misleading experiences due to retrieval bias and unclear tool credit, and full trajectories add context overhead while reducing interpretability. We propose RedEvoAgent, a black-box red-teaming agent that distills cross-case attack trajectories into a concise, human-readable attack skill. The attack skill adaptively evolves through tool-effectiveness profiling and Deciding-Tool Attribution for skill updates, and a validation ratchet that retains only updates improving validation performance. Experiments on multiple benchmarks, target models, and target execution harnesses show that RedEvoAgent outperforms fixed and agentic baselines, improves tool efficiency, and transfers across attacker models and target execution harnesses.