Skip to content

Back to the catalog

RedEvoAgent: Automatic Red-Teaming Agent with Experience-Driven Skill Evolution
arxiv.orgpaper

RedEvoAgent: Automatic Red-Teaming Agent with Experience-Driven Skill Evolution

RedEvoAgent is a black-box automatic red-teaming agent that distills successful jailbreak trajectories into concise, human-readable 'attack skills' rather than retrieving full past trajectories. It evolves these skills via tool-effectiveness profiling and a validation ratchet that only keeps updates improving attack success, and is shown to outperform fixed and agentic jailbreak baselines while transferring across attacker models and target execution harnesses (product-level agent environments where jailbreaks trigger real tool use, not just unsafe text).

TL;DR An LLM red-teaming agent that evolves compact, reusable 'attack skills' from past jailbreak trajectories to more efficiently break agentic execution harnesses.
Open original ↗
Document

What it is

RedEvoAgent's toolbox and the concrete artifact it evolves. The paper (arXiv:2608.27439, City University of Hong Kong / Shenzhen MSU-BIT) integrates seven jailbreak tools into an extensible attack toolbox: GCG (gradient search), AutoDAN (evolutionary search), AmpleGCG (generator-based suffixes), Template (predefined wrapping), FlipAttack (character-flipping disguise), RolePlay, and a proposed Prompt Substitution tool that uses an auxiliary LLM to rephrase a failed prompt while preserving intent. The attacker runs as a ReAct loop; each turn either calls a tool to optimize the current prompt or issues QUERYTARGET to probe the target.

How it works

Two mechanisms the summary abstracts as "tool-effectiveness profiling" are worth naming:

  • Tool-Effectiveness Profile: each tool is measured in isolation on the training split (per-tool ASR) before skill evolution, because a tool that works against one target-model/harness pairing may fail against another.
  • Deciding-Tool Attribution: rather than crediting every tool that co-occurs in a successful trajectory, only the tool whose output directly produced the successful query is labeled the deciding tool — this is the signal that prevents the skill from over-valuing frequently co-occurring but ineffective tools.

The attack skill itself is a Markdown document injected into the attacker's system prompt. The evolved skill in the case study encodes a "Direct-First, Measured-ASR Escalation" policy: try the bare request first, escalate to FlipAttack on refusal (FlipAttack ranks as preferred escalation in the learned tool priority), rotate to an untried strong tool on failure, never repeat a failed tool, stop on success.

Preconditions / Affected

The target is any black-box LLM agent in a product-level execution harness that can trigger real tool use and persistent state changes. Evaluated targets include the Claude Code and Codex execution harnesses, plus Agent Security Bench (ASB) and AgentHarm benchmarks across multiple target models.

Caveats

The fetched text states RedEvoAgent "outperforms fixed and agentic baselines" and transfers across attacker models and harnesses, but the excerpt contains no actual ASR numbers, deltas, or tables — the quantitative claims cannot be verified from this content. The authors note their reproduced Claude Code / Codex harnesses are offered as reusable infrastructure for future red-teaming research.

Technologies named here

Techniques named here

  • Agentic attack coordination
  • Trajectory-based retrieval
  • Attack skill distillation
  • Tool-effectiveness profiling
  • Deciding-Tool Attribution
  • Validation ratchet

Related in AI Security