Skip to content

Evolve the Method, Not the Prompts: Evolutionary Synthesis of Jailbreak Attacks on LLMs

🕒 Published (v1): 2025-11-16 17:52 UTC · Source: Arxiv · link

Ask a follow-up

Open an assistant pre-loaded with this paper's context.

💬 Ask ChatGPT✦ Ask Claude

TL;DR

EvoSynth shifts automated LLM jailbreak optimization from the prompt/strategy space into executable code space, using a multi-agent framework that synthesizes, evolves, and self-corrects attack algorithms rather than attack wordings. A Coordinator orchestrates specialized agents (Reconnaissance, Algorithm Creation, Exploitation) in a closed feedback loop that rewrites algorithm source code upon failure. It achieves 95.9% average ASR across seven frontier models, outperforming all 13 baselines.

Problem

Existing automated red-teaming frameworks (PAIR, X-Teaming, AutoRedTeamer, etc.) optimize in prompt space or strategy-selection pipelines: they search over what to say or which strategy to pick, not over executable procedures that generate attacks. This prevents them from autonomously inventing structurally novel attack mechanisms; failure feedback only updates prompts or strategy memory, not the underlying generative code.

Method

EvoSynth models the attack process as a structured trajectory \(\tau^*\) maximizing judge probability \(J(\tau)\), factored across five phases (Eq. 1):

\[p(\tau) = \prod_{k=0}^{K-1} p_\text{recon}(s_k|H_{k-1}) \cdot p_\text{create}(T_k'|T_k, s_k) \cdot \pi(\tau_{\text{exec},k}|s_k, T_k', H_{k-1}) \cdot \mathbb{I}[R_k] \cdot \mathbb{I}[T_{k+1}]\]

Reconnaissance Agent maps a harmful query \(q_\text{harm}\) plus conversation history \(H_{k-1}\) to an attack category \(c^*\) and concept \(a^*\).

Algorithm Creation Agent synthesizes a self-contained Python function \(f_t(q_\text{harm}) \to \tau_1\) (the initial attack prompt), then iteratively evolves it via dual feedback \((J_i, R_{\text{target},i})\): $\(t_{i+1} = G_\text{evolve}(t_i, F_i)\)$ until a validation condition \(V(t_i, J_i) = \text{is\_functional}(t_i) \wedge (\text{score}(J_i) \geq \theta_\text{perf})\) is satisfied.

Exploitation Agent selects an algorithm from the growing Arsenal \(T_k'\) via an entropy-regularized contextual bandit (Q-learning with Monte Carlo updates, Eq. 11): $\(Q_{k+1}(s_k, T_k', t_k) \leftarrow (1-\eta)Q_k + \eta R_k\)$

Coordinator Agent receives terminal reward from a judge, performs failure analysis, and re-tasks either the Reconnaissance or Creation agent to evolve strategy or code respectively.

Key Contributions

  • Reformulates automated jailbreaking as code-level algorithm synthesis: the optimized object is executable Python, not a prompt string.
  • EvoSynth: a four-agent (Reconnaissance, Creation, Exploitation, Coordinator) evolutionary framework with a code-level self-correction loop.
  • Algorithm Arsenal maintained across sessions with Q-learning-based selection policy for contextual algorithm reuse.
  • Empirical evaluation against 13 baselines across 7 frontier models under a strict black-box, 180-query budget constraint.

Results

  • 95.9% average ASR across Claude-Sonnet-4.5, DeepSeek-V3.2-Exp, GPT-4o, GPT-5-Chat, Llama-3.1-70B, Llama-3.1-8B, Qwen-Max — best of all 14 systems.
  • 85.5% ASR on Claude-Sonnet-4.5; next best baseline (X-Teaming): 52.5%.
  • 94.5% ASR on GPT-5-Chat; next best (X-Teaming): 88.5%.
  • 98.5% ASR on Llama-3.1-70B; 99.5% on Qwen-Max.
  • Semantic prompt diversity: median pairwise cosine distance ~0.82 vs. ~0.63 for X-Teaming.
  • Code-level diversity comparable to human-designed attacks in OpenRT, with slightly higher aggregate pairwise distance in Qodo-Embed-1-1.5B space.
  • Pearson \(r > 0.85\) between LLM judge scores and human annotators (1500 pairs); StrongREJECT correlation 0.92.

Limitations

  • Short-horizon regime (≤5 iterations empirically) necessitates reduction to contextual bandit; full soft Q-learning Bellman backup cannot converge reliably in this setting.
  • Attacker-side cost is not zero: EvoSynth incurs LLM API costs for code synthesis and evolution, though the paper claims parity with existing agentic baselines.
  • Evaluation uses a fixed 200-query Harmbench Standard dataset; generalization to other harm taxonomies or open-ended distributions is unverified.
  • The paper does not analyze failure modes where code synthesis itself diverges or produces syntactically invalid algorithms across many iterations.
  • Black-box only; no white-box or gray-box threat models explored.

Relevance to Harnesses / Meta-Harnesses

EvoSynth is itself a meta-harness: rather than directly producing attacks, it generates and manages a library of executable sub-harnesses (attack algorithms), each of which is itself a code object that can be selected, composed, and rewritten. The Coordinator + specialized-agent architecture with failure-driven re-tasking is a canonical meta-harness pattern — the system evolves how attacks are generated, not just what is generated. The Algorithm Arsenal with Q-learning-based selection implements the harness-level memory and policy that decides which sub-harness to deploy in which context. For researchers building general-purpose agentic harnesses, EvoSynth demonstrates that moving the optimization target up one level of abstraction (from outputs to the code that produces outputs) yields dramatic performance gains and is practically feasible with current LLM capabilities.